23 October 2026 · tech-expert.moscow editorial team
Which question about the correspondence needs resolving?
A single fragment may be used to try to establish different facts: message content, discussion sequence, file transfer or the connection between a reply and an earlier remark. Each task requires its own scope of materials. If a dispute concerns a version of the technical specifications, the attachment itself and messages approving it matter. If it concerns when notice of a defect was given, a timeline and time information are needed.
Preparation therefore begins with a list of disputed episodes. For each, identify the communication channel, participants, approximate period, key messages and related documents. This preserves relevant context while avoiding unnecessary transfer of all personal correspondence. Agree on the scope and access method before examination.
What a screenshot preserves
A screenshot records the visible part of the interface: text, displayed names, the arrangement of messages, timestamps and other elements within the frame. It is useful for a quick overview and identifying the disputed passage. A sequence of screenshots helps show how the user navigated from chat information to the relevant fragment.
However, earlier and later messages, hidden portions of long text, attachment contents and information not displayed by the interface remain outside the frame. A displayed name may be the contact name in the device owner's address book. The image alone cannot automatically identify a specific person. Cropping, resizing and resaving also reduce the information available.
What a chat export may add
An export presents correspondence in a format supported by the application. For example, Telegram Desktop can produce readable HTML or structured JSON. The official JSON schema provides for message identifiers, time, sender information and, where the relevant fields are present, reply relationships and editing markers. Media files may be stored separately and linked to records by relative paths.
This leads to a practical rule: provide the entire agreed export package while preserving its folder structure. Sending only the main JSON or HTML file may make photos, voice messages and documents unavailable. The presence of a particular field depends on the source data and export method. An export format alone does not guarantee a complete history or the authenticity of every message.
Why acquisition parameters must be recorded
Record the application and account used to save the materials, the device, when it was done and the settings used. The selected period, included attachment categories and any size limits matter. Preserve the software version and time zone information. If several exports are obtained, do not manually combine them into one file without separately documenting the actions taken.
Keep an original copy of the acquired folder and use a working copy for viewing and searching. Do not edit the original text for readability or replace filenames. An archive may be created for transfer while preserving its internal structure. The accompanying inventory should explain where each disputed episode is located and how it relates to individual attachments.
Email contains additional information
For email, preserve original messages in a format supported by the email client, together with full headers and attachments. Headers may contain addresses, a date, Message-ID and In-Reply-To or References fields linking messages into a thread. This information helps compare emails but must be checked in the context of the other materials.
Forwarding an email as plain text creates a new message and may not preserve all original technical fields. Printing to PDF is also designed for display rather than preserving every service field. A readable copy can therefore be attached as a supplement, identifying its source file. Individual headers should not be assessed from one field outside the overall examination.
Comparing different representations
- Establish the origin of each package and record acquisition details.
- Locate disputed messages and compare text, dates, participants, replies and attachments in the available representations.
- Account for time display format, time zone and application behavior.
- Separately record gaps, discrepancies, unavailable files and ambiguous links between messages.
- Distinguish what the materials establish from what requires an additional source or device access.
A discrepancy does not always mean the material was edited. It may result from a different save time, export range, renamed contact or display behavior. Check these explanations first, then draw a conclusion supported by the available data. Where necessary, list additional materials required to check each explanation.
Preparing a convenient examination package
- Preserve original images without additional annotation or compression; put explanations in a separate document.
- Add messages before and after the disputed fragment to preserve understandable discussion context.
- Attach the export with its attachment folders, original document files and a description of the save settings.
- Provide details of devices and accounts that can be accessed lawfully, and whether they can be inspected.
- Create a timeline of episodes with references to filenames, message numbers or pages in the readable copy.
If correspondence contains unrelated personal or confidential information, agree in advance on protection arrangements and the necessary scope of transfer. Mark any redactions in the working copy; preserve the original separately. This helps avoid accidentally removing context relevant to the question along with unnecessary data.
Conclusions that require additional data
A checksum allows files to be compared and checks whether they changed after a recorded storage stage. It does not certify the correspondence's author, sending date or the circumstances in which a screenshot was created. An export does not automatically become a certified history copy either. A technical conclusion must identify the materials examined, how they were compared and which questions lacked sufficient data.
Screenshots can be a useful part of the package. Their examination value depends on quality, context and whether other sources can verify them. Decisions on procedural use depend on the case circumstances; the technical examination's task is to disclose the available information and substantiate the limits of its conclusions.
Questions for examination
- Which messages, participant details and attachments are contained in the materials provided?
- Do the screenshots correspond to messages and files in the provided export in the characteristics that can be checked?
- What discrepancies were found, and could they be explained by save settings, export time or application display behavior?
- Can the sequence of disputed messages and their connection to specific attachments be established?
- What additional materials are needed to answer the technical questions raised?