Working with Digital Evidence: Messages, Metadata, Timelines

Digital evidence in a criminal case usually falls into three brackets: messages, metadata, and location data. Each is challenged in a different way, and each has its own detailed guide on this site. Getting digital evidence, messages, metadata, and defence strategy aligned early, before the police have finished building their account of events, often decides which arguments still have room to work later on. This page sets out how the three types fit together and points you to the right guide for your specific situation, so you do not have to read five separate articles to find advice that applies to you.

The Three Types of Digital Evidence, And How They Interact

Messages carry the content: what was said, to whom, and when. On their own, they rarely tell the whole story, because tone, context, and the identity of the sender all shape what a message means. Metadata sits behind the message. It includes timestamps, device identifiers, and the technical footprint an app leaves without the user seeing it, and it is often what turns a single message into part of a wider pattern. Location and timeline data ties the two together, placing a device, and by extension a person, somewhere at a given time.

None of these three types stands alone in a real case. A prosecutor typically combines them to build a chronological account: a message is read alongside the metadata that shows when it was sent, and the metadata is read alongside location data that shows where the device was at that moment. Criminal defence solicitors test each layer separately before accepting the combined account, because an error at any one layer, a mistimed timestamp, a shared device, an incomplete extraction, can change what the whole timeline appears to show.

Messages and Content: Where to Go for The Detail

Text threads, WhatsApp messages, and deleted content are typically the first material type seized and analyzed by the police. The rules around what they can take, and how, are covered in full in our guide to device seizure rights in criminal defence. That guide explains the powers officers rely on, what counts as a proportionate search, and how a solicitor challenges a request that goes beyond what the investigation actually needs.

Where messages form part of a sexual allegation specifically, the forensic and expert-evidence issues are different again, and criminal solicitors handling that kind of case will usually instruct a different set of experts entirely. Our guide to expert evidence in sexual offence cases sets out how psychiatric, DNA, and digital evidence interact in that context, and why the standard approach to a general criminal case does not always transfer directly.

Metadata and Timelines: Where to Go for The Detail

Metadata is what turns a message into a timeline, and it is also where extraction errors most often creep in. Different platforms store this information differently, which means a timeline built from several apps at once can contain gaps that are not obvious until someone goes looking for them. Our guide on social media evidence, context, and metadata covers how investigators pull this material together, and where the reliability problems tend to sit.

For the more specific question of cell-site data and how it is used to place a device at a location over time, see our guide to cell site analysis and timeline evidence. That page goes into the detail this overview does not, including how coverage areas work and why a connection to a mast is not the same as proof of an exact location.

Preserving Evidence Early: Where To Go For The Detail

What happens to a device, and to the material on it, in the days after a first police contact often shapes the rest of a case. Devices that are not properly preserved can lose data that would otherwise have supported the defence, and gaps created this way are difficult to explain later. For the practical steps to take before charge, see our guide to protecting devices before charge, which sets out what to do, and what to avoid doing, in the period immediately after you learn you are under investigation.

How A Solicitor Pulls These Together Into One Defence Timeline

None of this material is reviewed in isolation. A solicitor cross-references message content against metadata, and metadata against location and call data, to find where the prosecution account has gaps or relies on assumptions about who was actually using a device at the time. Working through digital evidence, messages, metadata, and defence strategy as one connected exercise, rather than as separate items on a disclosure list, is what allows a genuine alternative timeline to emerge rather than a series of isolated objections.

This is also where instructing the right expert matters. Criminal defence lawyers do not instruct a digital forensics expert as a matter of routine; they do so where extraction methodology, continuity, or metadata reliability is genuinely in dispute, and where an independent report is likely to change the picture rather than simply confirm what the police already found. That single, tested timeline, not the individual pieces of evidence, is what ultimately shapes the strategy a defence team puts to the Crown Prosecution Service (CPS) or, where the case proceeds, to a jury.

How Holborn Adams Works On Your Defence

• We organise disclosure and case papers from the first instruction, and pursue unused and third-party material proactively rather than waiting for it to be offered.
• We instruct independent digital forensics experts where extraction methodology or continuity is genuinely in dispute, rather than as a default step.
• We prepare issues lists with counsel, mapped to the specific evidence in your case rather than a generic checklist.
• We advise from the pre-charge stage onward, since early engagement with investigators can influence a charging decision before it is made. See our pre-charge solicitor representation page for how that process works in practice.

Practical Cautions

• Preserve your devices, messages, and accounts. Do not delete anything that could form part of the evidence, even material you believe is unhelpful to you.
• Comply with bail or release under investigation conditions (RUI), and keep a written record of any contact you have with the police.
• Avoid contact with witnesses or complainants, and do not comment on the case on social media, even in general terms.
• Tell your solicitor about any change of address, employment, or travel plans, since these can affect bail conditions or the progress of the case.

Speak To A Solicitor About Your Case

If a specific part of this article applies to you, the linked guides above go into far more detail that can assist you with your own case. If however, you are still unsure about which one best fits your situation, get in touch and start a conversation with our team. Working through digital evidence, messages, metadata, and defence options together gives you a much clearer picture of where you actually stand than trying to piece it together from a single article alone.

This article is intended for general information only and does not constitute legal advice. For confidential advice about digital evidence in your case, contact Holborn Adams to speak with an experienced solicitor.

Frequently Asked Questions

1.  Can text messages be used as evidence in a UK criminal case?

Yes. Text messages and app content are routinely used as evidence, provided they can be authenticated and are relevant to the case.

2. Can the police access deleted messages on your phone?

Yes. Mostly with forensic recovery software. How much can be recovered depends on the device and the extraction method.

3. How long can the police keep your phone during an investigation?

There is no fixed time limit. A phone can be held for weeks, months, or longer while forensic analysis and the wider case continue.

4. Do the police need a warrant to search your phone?

Not always. If they have a warrant, or on arrest, officers can seize and inspect a phone if they reasonably believe it contains relevant evidence.

5. Can WhatsApp messages be used as evidence in court?

Yes. Encryption protects messages in transit, but the police can still recover them directly from a seized device.

6. Do you have to give the police your phone password?

You are not legally required to, though refusing can extend how long your device is held while officers try another way in.

7. What does metadata actually mean in a digital evidence case?

It’s the data behind the data: timestamps, device IDs, and location tags telling you when and where a message or file was created.

8. What is cell-site evidence, and how reliable is it?

It shows which phone mast a device connected to, giving an approximate area rather than an exact location, so it is less precise than it sounds.

9. Can you be convicted on text messages alone?

It’s possible, but messages don’t exist in a vacuum. They are evaluated by the courts together with metadata, other evidence, and the context of both.

10. Can digital evidence be challenged or excluded from a trial?

Yes. Evidence obtained unlawfully or unreliably can be challenged and, in some cases, excluded via a formal application.