# Evidence preservation and acquisition

## Current access finding

On September 18, 2026, a read-only SQLite attempt against the Mac Messages database returned `authorization denied`. The Messages app's accessibility view was available, but filter entries appeared disabled, screenshots were unavailable, and a subsequent action reported that the user changed the app. No Unknown Senders inventory or complete conversation review was completed. No message content was saved into this project.

Do not work around operating-system privacy controls. A future export requires an explicitly approved access path or an export James creates. No settings were changed. Do not infer absence of evidence from failed access.

## First preservation pass

1. Make a private working folder outside public sync/hosting, or under ignored `private/`. Protect it with disk encryption and an encrypted backup. Keep an originals folder separate from working copies.
2. Preserve the relevant full conversations, including incoming/outgoing messages, STOP replies, subscription confirmations, edits, timestamps, sender details, and attachments. Include context that weakens a claim. Preserve originals before blocking/reporting/deleting; do not delay an opt-out James wants in order to generate more contacts.
3. Capture the relevant Messages UI with the sender's actual number/address and expanded dates visible. Record device, OS version, timezone, capture time, and who captured it. Screenshots supplement—not replace—the underlying messages and testimony.
4. For calls, preserve carrier records, call-history screenshots, existing voicemail/audio, date/time/duration, and contemporaneous notes. A missed call proves neither sales content nor prerecorded voice. Do not initiate call recording until applicable consent law is checked.
5. Save registry verification, number ownership/use history, prior opt-in records, purchases/inquiries, and opt-out records. Keep the full number private; use an internal alias in routine reports.
6. Create a manifest: evidence ID, relative path, original source, acquisition method/version, acquisition UTC time, displayed local time/zone, SHA-256, custodian, and missing-data notes. Hash files at acquisition and check hashes before packaging. Hashes show subsequent consistency, not who sent a message.

## Export options

**Immediate fallback:** James can capture selected complete conversations and sender details on the phone/Mac and place them in the private evidence area. Start with repeated apparent business marketing. Do not upload the entire Messages history to a third-party service.

**Preferred repeatable path:** evaluate [imessage-exporter](https://github.com/ReagentX/imessage-exporter) with approved access. Inspect the pinned release's [usage documentation](https://github.com/ReagentX/imessage-exporter/blob/develop/imessage-exporter/README.md) before execution; apply available date/conversation filters. Preserve export diagnostics, release/version, exact invocation, and raw files. Do not assume it reproduces Apple's Unknown Senders category.

**Source snapshot:** if a database snapshot is authorized, use a consistent SQLite-aware backup or a verified complete source capture; copying only a live `chat.db` can omit write-ahead-log transactions. Preserve associated attachments and note iCloud-only/missing items. Avoid homegrown Apple timestamp/body decoding as the first implementation.

## Verification before using any export

- Compare at least five complete sample conversations, including a multipart/attachment case if present, against the Messages UI.
- Reconcile counts and sender/recipient/direction/date/body for every contact in a proposed claim. Confirm the actual destination number; an Apple account may combine multiple numbers and email addresses.
- Distinguish SMS, MMS, RCS, and iMessage where available; never silently treat all transports as SMS.
- Treat blank bodies, missing attachments, edit histories, reactions, merged contacts, and timezone ambiguity as explicit exceptions.
- Repeat an import on unchanged inputs: same event count, stable IDs, no duplicated contacts. Preserve duplicate source files while deduplicating derived events.
- Disable active links/remote assets in rendered case reports. Do not click shortened marketing URLs to discover identity; first research independently using public business sources.

## Minimum event record for later software

`event_id`, source message ID (if available), conversation ID, source/evidence IDs, receiving-number alias, original sender handle, transport, direction, raw timestamp, normalized UTC timestamp, local timezone, unmodified body reference, attachment references, edit/reaction relationship, import version, completeness status.

Keep legal interpretation in a separate review record: candidate seller/entity, identity evidence, marketing assessment, consent/relationship/revocation findings, rule/theory, jurisdiction, effective-date source, reviewer, unresolved questions, and decision. Never overwrite a preserved fact with an AI inference.