Question 1

Can Whats App itself give us the messages?

Accepted Answer

No: end-to-end encryption means the provider holds no readable content, and legal process against the platform yields account, registration and group metadata at most. The content routes are the ends: devices, backups and participants: which is why this guide is an architecture map rather than a subpoena template. Business API deployments (companies running Whats App through business tooling) are the exception worth checking: their message flows may be archived enterprise-side.

Question 2

Messages were deleted months ago. Realistic prospects?

Accepted Answer

Decomposed, per §4: for-me deletions: good prospects via database layer (if extraction comes before vacuum), backups and counterparts; for-everyone: placeholders plus any backup or not if i c at i on residue pre-window, plus counterpart copies where the window missed; vacuumed and unbacked: the honest no, with the deletion's own record remaining. The single best predictor is backup lineage: a weekly cloud backup habit means the question is usually "which set", not "whether".

Question 3

Are Whats App messages even admissible: aren't they hearsay?

Accepted Answer

They are documents, disclosed and admitted like any other, with hearsay rules apply in g to their contents as they would to a letter: the practical battleground is authenticity and completeness, not admissibility: which is why §7's workups matter more than evidence-law anxiety. Present threads threaded, sourced and complete (selective quotation invites the completeness attack), with the extraction pedigree stated: the presentation disciplines of guide 56 §13 apply.

Question 4

The other side produced a chat export. Do we accept it?

Accepted Answer

As a start, not an end: exports are editable text artefacts. The §11 request asks for the underlying extraction and source-device access; the comparison (export against extracted store, and against your client's own copy of the thread) is quick and decisive; and divergences: messages present in one, absent in the other: are findings, not formalities. Accept nothing contested on format alone.

Question 5

Our client screenshot everything and deleted the originals "to save space". How bad?

Accepted Answer

Recoverable, usually: the screenshots become leads; the database layer may retain the deleted records if extraction moves fast; backups predating the clear-out likely hold the threads; and counterparts hold their ends regardless. The honest account of the deletion goes in the file now: innocent housekeeping explained early reads entirely differently from the same facts excavated by the other side later. Then the ordinary machinery runs.

Question 6

Do we need every group member's phone?

Accepted Answer

Rarely: two or three independent, cooperative members' extractions converging at record level authenticate a thread to the standard courts need (Example 2 used four of eleven); the selection favours members with long tenure, intact stores and backup habits. The full membership matters for preservation (letters) and for divergence analysis where deletion dating is itself in issue: collection scales to the questions, per the proportionality dial this series runs every where. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

WhatsApp Evidence