Guide
WhatsApp Evidence
17 pages · 22 min read
This guide, 'Whats App Evidence', covers the complexities of Whats App data for UK lawyers, litigators, in-house counsel, and investigators.
- Mobile and messaging evidence
§ Guide
WhatsApp Evidence
This guide, 'Whats App Evidence', covers the complexities of Whats App data for UK lawyers, litigators, in-house counsel, and investigators.
Ref · E-D · 2026 · §LIBClass · ConfidentialJuris · England & WalesStatus · Active
Guide · 17 pages · 22 min read · Published 2026-08-30
This guide, 'Whats App Evidence', covers the complexities of Whats App data for UK lawyers, litigators, in-house counsel, and investigators. It addresses the architecture of Whats App, including databases, media, backups, and linked devices. Key topics include deletion mechanisms ('for-me', 'for-everyone'), group chats, disappearing messages, and authentication challenges like the 'screenshot problem'. The guide also explores common mistakes, technical limitations, and provides questions to ask clients, opponents, and e Discovery providers. It outlines when to involve a digital forensic expert, offering a checklist and red flags. This resource is essential for understanding WhatsApp's role in UK business and litigation, particularly concerning evidence preservation and admissibility.
Share
Read this guide on your phone, browse guides by topic or go back to the full PDF library.
§ Credit and source
Published by Computer Forensics Lab on 2026-08-30. Original material of the practice, free to read, cite and download. The authority behind this subject is Forensic Science Regulator Code of Practice, digital forensics, which you should read alongside this guide. See every guide's author and source.
§ Full text of WhatsApp Evidence
Download the PDFPrefer a PDF that matches this page exactly? Download the current text as a PDF, generated from the wording shown here, including any later corrections.
Page 1
WHATSAPP EVIDENCE · A GUIDE FOR UK LAWYERS Whats App Evidence Databases, Backups, Deleted Messages, Groups and Linked Devices: the App That Runs UK Business on the Side COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKUP & DELETED-DATA ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encrypted in transit, every where at rest 03 The architecture: databases, media, backups, linked devices 04 Deletion: for-me, for-everyone, and what each leaves 05 Groups: multiplied evidence, multiplied duty 06 Disappearing messages and the preservation race 07 Authentication: threads, exports and the screenshot problem 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WHATSAPP ' SENCRYPTIONGUARDSTHEWIRE, NOT THE END S: ANDLITIGATIONLIVESATTHEENDS
§ 02 · FIRST PRINCIPLES The problem in plain English: encrypted in transit, every where at rest
§ 03 · THEARCHITECTURE The architecture: databases, media, backups, linked devices COMPONENT WHAT IT HOLDS · WHAT MATTER S
Page 2
§ 04 · WHATDELETIONLEAVES Deletion: for-me, for-everyone, and what each leaves
§ 05 · GROUPS Groups: multiplied evidence, multiplied duty
§ 06 · THERACE Disappearing messages and the preservation race
§ 07 · ISITREAL? Authentication: threads, exports and the screenshot problem
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BACKUP PRIMARY COMPUTER LINKED COUNTERPART DELETED / DEVICE (FFS) BACKUPS DEVICES PARTICIPANTS RECOVERABLE CLOUD LINEAGE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETE - FOR - EVERYONETHATDATEDITSELF EXAMPLE2 · THEGROUPTHATOUTVOTEDTHEWIPEDPHONE EXAMPLE3 · THESCREENSHOTTHREADTHATNEVEREXISTED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · WH AT SAPPLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Whats App checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can Whats App itself give us the messages? Messages were deleted months ago. Realistic prospects? Are Whats App messages even admissible: aren't they hearsay? The other side produced a chat export. Do we accept it? Our client screenshot everything and deleted the originals "to save space". How bad? Do we need every group member's phone?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
§ Common questions
Frequently asked questions
- Can Whats App itself give us the messages?
- No: end-to-end encryption means the provider holds no readable content, and legal process against the platform yields account, registration and group metadata at most. The content routes are the ends: devices, backups and participants: which is why this guide is an architecture map rather than a subpoena template. Business API deployments (companies running Whats App through business tooling) are the exception worth checking: their message flows may be archived enterprise-side.
- Messages were deleted months ago. Realistic prospects?
- Decomposed, per §4: for-me deletions: good prospects via database layer (if extraction comes before vacuum), backups and counterparts; for-everyone: placeholders plus any backup or not if i c at i on residue pre-window, plus counterpart copies where the window missed; vacuumed and unbacked: the honest no, with the deletion's own record remaining. The single best predictor is backup lineage: a weekly cloud backup habit means the question is usually "which set", not "whether".
- Are Whats App messages even admissible: aren't they hearsay?
- They are documents, disclosed and admitted like any other, with hearsay rules apply in g to their contents as they would to a letter: the practical battleground is authenticity and completeness, not admissibility: which is why §7's workups matter more than evidence-law anxiety. Present threads threaded, sourced and complete (selective quotation invites the completeness attack), with the extraction pedigree stated: the presentation disciplines of guide 56 §13 apply.
- The other side produced a chat export. Do we accept it?
- As a start, not an end: exports are editable text artefacts. The §11 request asks for the underlying extraction and source-device access; the comparison (export against extracted store, and against your client's own copy of the thread) is quick and decisive; and divergences: messages present in one, absent in the other: are findings, not formalities. Accept nothing contested on format alone.
- Our client screenshot everything and deleted the originals "to save space". How bad?
- Recoverable, usually: the screenshots become leads; the database layer may retain the deleted records if extraction moves fast; backups predating the clear-out likely hold the threads; and counterparts hold their ends regardless. The honest account of the deletion goes in the file now: innocent housekeeping explained early reads entirely differently from the same facts excavated by the other side later. Then the ordinary machinery runs.
- Do we need every group member's phone?
- Rarely: two or three independent, cooperative members' extractions converging at record level authenticate a thread to the standard courts need (Example 2 used four of eleven); the selection favours members with long tenure, intact stores and backup habits. The full membership matters for preservation (letters) and for divergence analysis where deletion dating is itself in issue: collection scales to the questions, per the proportionality dial this series runs every where. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17
§ Related documents
Guide
IPhone And IPad Forensics The Acquisition Challenge
17 pages · 25 min read
- Forensic collection and imaging
- Mobile and messaging evidence
Guide
Android Backups Local Google And Manufacturer Cloud
19 pages · 26 min read
- Mobile and messaging evidence
- Cloud evidence
Instruct the practice
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.