Identifying fake vs. real communication records: a case study

Records of communication often play an important role in many criminal inquiries giving insight into existing and alleged relationships. The forensic analysis of digital devices can provide such information, however in some cases, screen captured records may be all that is available. In these instances, it is necessary to evaluate the authenticity of this information given the availability of free to use communication record mockup services that can be used to create realistic looking, but fictitious communication records. This work seeks to ascertain whether freely available communication record mockup services pose a threat to law enforcement officers in terms of not being able to distinguish a communication record mockup from a genuine communication record screen capture. An evaluation of communication record mockup services for creating WhatsApp, iMessage and Twitter mockups are identified and their ability to create realistic communication record mockups is evaluated. The results of these tests are provided and discussed, and 41 communication record mockups are supplied forming one of the first datasets to support those conducting communication record authenticity checks.