EncroChat and volatile memory: reconstruct the message state before interpreting the extract

365 ALTERAM analysis

A message is a sequence of technical states

A communications export presents text in a form a lawyer can read. The underlying application may have handled that text through several different states before the export existed. The focused forensic question is therefore: what exactly was captured, at which stage, and which later transformations produced the exhibit?

This question is distinct from identifying a user. It concerns the relationship between application behaviour, memory and the evidential record. A useful technical report explains that relationship without presenting a software label as a legal conclusion.

Public record

Public record: the distinction mattered, but the challenge failed

On 5 February 2021, the Court of Appeal in A, B, D & C v Regina examined whether EncroChat material was obtained during transmission or from storage. Its judgment described evidence about historic extraction and subsequent collection from device memory. On the factual findings before it, the Court held that the communications were stored on the handsets when intercepted and were admissible through the statutory route it analysed. It dismissed the appeal. This was an admissibility ruling, not a verdict establishing the underlying allegations. [1]

Importantly, the Court distinguished expertise explaining system operation from judicial interpretation of legislation. A technical account of RAM did not itself determine the meaning of the statute. [1]

In Murray, dated 16 March 2023, the Court explained that the earlier Atkinson decision had rejected, on further expert evidence, the proposed alternative that material was extracted during transmission. Murray also dismissed the conviction and sentence applications identified in its opening paragraph. Repeating an already rejected possibility is not equivalent to producing new evidence. [2]

Later litigation needs precise reporting. In Aziz, dated 9 May 2025, the Court granted permission on two conviction grounds while refusing the others; it dismissed the sentence-related applications. Limited permission to argue an appeal is not an acquittal or a finding that the data were unreliable. [3]

365 ALTERAM analysis

Map the capture event, not just the conversation

For a new instruction, start with a capture-state table. Identify each available source, the relevant software version, the acquisition stage and the event represented by each time field. Distinguish an application event time from collection, receipt by an investigative system and later processing. Preserve the original field names alongside any translated or normalised labels.

Place these events on separate timeline layers. A timestamp displayed beside a message cannot safely be assumed to describe every stage. Clock differences, batching or delayed processing are possibilities to test against documentation and records; they must not be asserted as defects without evidence.

Ask the specialist to identify the basis for each statement: observed bytes, acquisition documentation, controlled testing or inference. If an extraction mechanism cannot be examined directly, explain what can still be checked and what remains outside the available material.

365 ALTERAM analysis

Test the export against its actual source

A reproducible review records the supplied dataset, integrity checks, parser version and transformation steps. Select representative records for comparison between the available source material and the rendered output. Include ordinary records and exceptions; testing only apparent anomalies can produce a misleading picture.

A controlled test on a comparable application may help evaluate a decoding assumption, but only if the relevant behaviour is comparable. A demonstration on a different version or configuration cannot establish how a historical capture operated. Document those differences and avoid turning an illustrative experiment into a claim about the prosecution dataset.

Check whether adjacent context survives and whether the export indicates missing, repeated or reconstructed elements. An unexplained field requires investigation. It does not automatically establish corruption, interception illegality or innocence. Consistent decoding and independently corroborated content may instead strengthen the evidential account.

365 ALTERAM analysis

Give counsel a bounded technical conclusion

The useful deliverable is a capture-state diagram, a timestamp dictionary and a record-level audit trail. State which propositions the examination supports, which it contradicts and which cannot be resolved. Explain the materiality of any discrepancy rather than merely counting discrepancies.

365 ALTERAM’s complex data-structure forensics service examines application metadata, storage structures and relevant volatile-memory artefacts with appropriately qualified specialists. The objective is an inspectable explanation of the evidence. Counsel determines the legal arguments and the court decides admissibility and weight.

The EncroChat record supplies an essential discipline: forensic independence includes reporting that a challenge lacks technical support. Deeper examination can narrow a genuine issue, confirm the existing interpretation or remain inconclusive. It cannot promise exclusion of evidence or a reduced sentence.