Page 1
WHATSAPP EVIDENCE · A GUIDE FOR UK LAWYERS Whats App Evidence Databases, Backups, Deleted Messages, Groups and Linked Devices: the App That Runs UK Business on the Side COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKUP & DELETED-DATA ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encrypted in transit, every where at rest 03 The architecture: databases, media, backups, linked devices 04 Deletion: for-me, for-everyone, and what each leaves 05 Groups: multiplied evidence, multiplied duty 06 Disappearing messages and the preservation race 07 Authentication: threads, exports and the screenshot problem 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WHATSAPP ' SENCRYPTIONGUARDSTHEWIRE, NOT THE END S: ANDLITIGATIONLIVESATTHEENDS
§ 02 · FIRST PRINCIPLES The problem in plain English: encrypted in transit, every where at rest
§ 03 · THEARCHITECTURE The architecture: databases, media, backups, linked devices COMPONENT WHAT IT HOLDS · WHAT MATTER S
Page 2
§ 04 · WHATDELETIONLEAVES Deletion: for-me, for-everyone, and what each leaves
§ 05 · GROUPS Groups: multiplied evidence, multiplied duty
§ 06 · THERACE Disappearing messages and the preservation race
§ 07 · ISITREAL? Authentication: threads, exports and the screenshot problem
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BACKUP PRIMARY COMPUTER LINKED COUNTERPART DELETED / DEVICE (FFS) BACKUPS DEVICES PARTICIPANTS RECOVERABLE CLOUD LINEAGE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETE - FOR - EVERYONETHATDATEDITSELF EXAMPLE2 · THEGROUPTHATOUTVOTEDTHEWIPEDPHONE EXAMPLE3 · THESCREENSHOTTHREADTHATNEVEREXISTED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · WH AT SAPPLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Whats App checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can Whats App itself give us the messages? Messages were deleted months ago. Realistic prospects? Are Whats App messages even admissible: aren't they hearsay? The other side produced a chat export. Do we accept it? Our client screenshot everything and deleted the originals "to save space". How bad? Do we need every group member's phone?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, WhatsApp Evidence, Computer Forensics Lab, https://e-discovery.uk/library/whatsapp-evidence/pdf.