Message Status Flag
Definition
An integer column in a messaging database that encodes the state of a message: sent, delivered, read, failed, or draft. The exact flag values differ by platform and app version. Misreading these flags is a common source of analytical errors.
- Data type
- Integer column in messaging database
- Encodes
- Sent, delivered, read, failed, draft
- Consistency
- Differs by platform and app version
- Common error
- Misreading flag values
Common questions
Why can't an examiner assume the same flag value means the same thing across two devices?+
Messaging apps define their own integer encoding for status, and that encoding can also change between app versions on the same platform, so a value meaning 'delivered' in one database dump can mean something else in another without reference to that specific app's schema.
What is the practical consequence of misreading a status flag in a report?+
An examiner could wrongly state a message was read when it was only delivered, or vice versa, which can materially affect an argument about whether a party saw a communication before acting. Validating flag meanings against a known reference for that exact app version is standard practice.
Related terms
- Content Provider (Android)
- An Android system component that mediates access to shared data such as call logs and SMS. Forensic logical extractions query content providers...
- Free Page (SQLite)
- A SQLite database page that has been deallocated after a delete operation but not yet reused. Residual message data in free pages...
- SQLCipher
- An open-source SQLite extension that encrypts the entire database file using AES-256. Used by Signal and some other security-focused messaging apps. Without...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Unix Epoch Timestamp
- An integer representing the number of seconds (or, in some databases, milliseconds or nanoseconds) since 00:00:00 UTC on 1 January 1970. Mobile...