Text Messaging and Digital Language as Evidence

Linguists who study computer-mediated communication note that digital written language has developed its own conventions that differ markedly from both formal writing and transcribed speech. Some features are nearly universal: truncated words, phonetic spellings, missing punctuation, and frequent use of capital letters or repeated characters for prosodic effect ("FINE" to signal frustration, "noooo" to signal dismay). Others are platform-specific or community-specific.

• Abbreviations and acronyms: forms like "lol", "tbh", "omg", and "ngl" are so widespread they function as single lexical items, but their use patterns still vary by age, community, and individual.
• Emoji and emoticons: used for tone modulation, irony signalling, and topic punctuation. Individual emoji selection and combination patterns can be distinctive enough to feature in authorship analysis, though the evidential bar is high.
• Response timing: the gap between a received and a sent message carries pragmatic meaning in digital conversations : an immediate reply signals urgency; a 12-hour gap signals disengagement or deliberation. Metadata timestamps make this measurable.
• Code-switching: bilingual or multilingual users frequently switch languages mid-conversation or even mid-sentence, a pattern that can identify both the user's linguistic background and shifts in topic or register.
• Platform-specific norms: Twitter/X posts have different syntactic constraints than WhatsApp messages; Reddit comments differ from SMS. An analyst needs to know the platform's conventions to distinguish idiosyncratic from generic features.

The forensic implication is significant: the features that mark digital language as informal are the same features that make it individuating. Formal writing suppresses individuality through shared conventions; an unselfconscious text to a close contact does not.

Before any linguistic analysis of a digital message can have weight in court, two prior questions must be answered: is this the original message, and has it been handled in a way that rules out modification? These are not linguistic questions : they belong to digital forensics : but a forensic linguist working on digital evidence must understand them because the answers constrain what conclusions language analysis can support.

The standard approach in digital forensics is to image the device immediately on seizure, producing a bit-for-bit copy, and to verify the image with a cryptographic hash (typically SHA-256 or MD5). Every subsequent step : extraction, analysis, presentation : operates on the copy, and the hash can be re-checked at any point to confirm the data is unaltered. If this process was not followed correctly, defence counsel can argue that the message content cannot be relied upon.

Metadata offers a parallel layer of verification. The sender identifier, timestamp, delivery receipt, and read receipt embedded in the platform's data stores are typically harder to falsify than the message body, especially when corroborated by server-side records from the platform operator. Timestamps from multiple independent sources : the sender's device, the recipient's device, and the platform server : that all agree give a much stronger foundation than any single source alone.

Classical forensic stylometry works by counting stable features over a large enough corpus. Function words : "the", "of", "and", "to" : are particularly useful because writers use them unconsciously and their frequencies are hard to consciously manipulate. On texts of several hundred words, these methods can distinguish authors with high reliability. At 30 words, the sample is simply too small for the statistics to hold.

Short-text authorship analysis is not therefore useless. The method changes. Rather than measuring frequencies, the analyst looks for the presence or absence of specific forms that are individually distinctive: a rare abbreviation used consistently, an unusual spelling that appears in both the questioned message and the suspect's known writing, an emoji used in a particular pragmatic context. These are point features rather than distributional features, and they require a different analytical approach: targeted comparison of discrete markers rather than regression across many variables.

The comparison corpus is equally critical. If the analyst claims that a suspect's characteristic use of "2day" matches the questioned message, they need to know how common "2day" is in the relevant population. Without base-rate data for the demographic, a feature that looks distinctive may be standard in that community. Published corpora of SMS and messaging language, such as the NUS SMS Corpus, provide reference points, though none covers all platforms, dialects, or time periods.

Damilola Taylor, a 10-year-old boy, was stabbed and killed in Peckham, south London, in November 2000. The initial prosecution collapsed in 2002 when the key witness was severely discredited. A second prosecution in 2006 resulted in the conviction of two brothers, Danny and Ricky Preddie, for manslaughter. The case is significant in the digital evidence context because it represented an early serious use of mobile phone evidence : call records and message data : to help establish the movements and communications of suspects in the period before and after the killing, at a time when digital evidence in criminal proceedings was still an emerging practice.

The case illustrates a pattern that recurs across early digital-evidence prosecutions: phone records function as a timeline even when witnesses are unavailable, intimidated, or unreliable. The metadata : who called whom, when, from which cell tower : can corroborate or contradict other accounts without any linguistic analysis of message content. When the content is also available, it adds a layer of meaning to the timeline.

When a user deletes a message on a mobile device, the operating system typically marks the storage space as available for reuse rather than overwriting the data immediately. Until new data is written to that space, the deleted message may be recoverable in whole or in part. Mobile device forensics tools : Cellebrite UFED, Oxygen Forensic Detective, and others : exploit this to extract deleted SMS records, deleted WhatsApp, Signal, and Telegram conversations, and deleted email.

Recovered fragments present a specific analytical challenge. If only part of a message thread is recovered, such as the outgoing messages but not the incoming, or the first half of a conversation before overwriting, the linguistic analyst must work with incomplete context. Pragmatic interpretation of fragments requires care: a recovered message saying "do it tonight" means something very different depending on what preceded and followed it, and if only half the thread survives, that context is missing.

• Platform database structure: messaging apps store conversations in SQLite databases with specific schemas; understanding the schema tells analysts which tables to examine for deleted-record remnants.
• Cloud corroboration: if the sender's device was backed up to iCloud, Google Drive, or a platform's own servers, the deleted message may exist intact in the backup, potentially recoverable with appropriate legal process.
• Recipient evidence: the other party in a conversation holds a copy of every inbound message. The sender deleting their copy does not affect the recipient's copy, so evidence can be obtained from both ends.
• End-to-end encryption: platforms like Signal use encryption that means server-side records contain ciphertext only. Recovery depends on physical access to the device and its decryption keys, not server data.

A recurring problem in digital message cases is that jurors read informal messages through the conventions of formal written language. A grammatically fragmented, emoji-heavy message can appear aggressive, evasive, or illiterate when it is merely informal. Contextualising the register of the messages is therefore a standard part of the expert's role, prior to any opinion on authorship or meaning.

Ambiguity in short texts is genuine and persistent. Tone, irony, and pragmatic intent that would be conveyed by vocal prosody in speech must be reconstructed from context in a text message, and that reconstruction is interpretive. Courts in the United Kingdom, Australia, and the United States have grappled with whether expert evidence on the meaning of specific messages invades the jury's province. The prevailing view is that an expert may contextualise register and explain linguistic features, but opinions on the ultimate meaning of a disputed message should be carefully scoped.