SMS, iMessage, WhatsApp, Teams, Slack and email
Messaging and Communications Review
Independent review of messages and related records across mobile, workplace and email platforms to explain chronology, conversation context, provenance and evidential limits.
Direct access to Alistair Ewing · Free initial consultation · Written estimate before work
Review the conversation, not just selected screenshots
A dispute may span SMS or iMessage, WhatsApp, Teams, Slack and email, with attachments or decisions moving between them. A focused review identifies the relevant participants, period and proposition, then compares the best lawfully available sources rather than assuming that every export or screenshot represents the complete conversation.
Sources can include device extractions, native chat exports, workplace-platform exports, Microsoft 365 eDiscovery material, native emails and account records. A chronology should retain source, time basis, participant labels and gaps. Business-platform access and export require authority. The work distinguishes an observed account or device event from an inference about the human author.
Questions a communications review may address
- Whether screenshots, schedules, exports and extraction records are consistent with one another.
- Whether replies, attachments, participants or surrounding messages change the apparent context.
- How timestamps, time zones, edits, deletions, forwarding and synchronisation affect the sequence shown.
- Whether the same event is reflected across other sources, and which authorship questions remain unresolved.
Useful sources to retain
- Original mobile devices and existing forensic extraction packages where relevant and lawfully available.
- Native chat exports with their folder structure and media, rather than copied text alone.
- Teams, Slack or other workplace exports with their settings and retention information, plus native emails where relevant.
- Screenshots, served schedules and an account of who produced them and how.
Limits that must remain visible
- Screenshots and copied text usually omit source structure, identifiers and some surrounding context.
- Platform exports vary by plan, permissions, date range, retention and export type.
- Deleted-message recovery depends on the device, platform, settings and subsequent activity and cannot be guaranteed.
- Synchronisation, migration or restoration can affect copies, while an account, address or device record does not by itself identify the human author.
What helps define a proportionate review
- Party names, platform names, participants and the date range in issue.
- The particular conversation, omission, authenticity or chronology question.
- Available devices, extractions, exports, screenshots, platform access, approximate volume and known gaps.
- Jurisdiction, required output, deadline and funding basis.
Please do not attach evidence, passwords or confidential case papers to the public enquiry. A secure route is agreed only after the conflict check.
Official platform context
Exports do not all contain the same records
Microsoft documents where Teams compliance records and linked files are searched. Slack explains the availability of workspace exports and what its JSON or text exports contain. WhatsApp states that an exported chat is a text file, not a restorable backup. For email, RFC 5322 defines message identifiers, reply references and trace fields.
Frequently asked questions
Can messages from several platforms be put into one chronology?
Yes, where the sources and time bases can be reconciled. The chronology should retain each item’s source and mark uncertainty, missing periods and duplicates rather than conceal them.
Can screenshots prove that a message is genuine?
A screenshot can record what was displayed, but usually offers less provenance and context than a native export, platform record or device extraction. Its weight depends on the other material available.
Read all questions about fees, timing, evidence and instructing Alistair
Initial enquiry
Need the full communication sequence put into context?
Describe the platforms, participants, period, available sources and the question to be answered. Keep messages and files out of the public form until a secure route and scope are agreed.