Page 1

WHATSAPP EVIDENCE · A GUIDE FOR UK LAWYERS Whats App Evidence Databases, Backups, Deleted Messages, Groups and Linked Devices: the App That Runs UK Business on the Side COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM BACKUP & DELETED-DATA ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encrypted in transit, every where at rest 03 The architecture: databases, media, backups, linked devices 04 Deletion: for-me, for-everyone, and what each leaves 05 Groups: multiplied evidence, multiplied duty 06 Disappearing messages and the preservation race 07 Authentication: threads, exports and the screenshot problem 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WHATSAPP ' SENCRYPTIONGUARDSTHEWIRE, NOT THE END S: ANDLITIGATIONLIVESATTHEENDS

§ 02 · FIRST PRINCIPLES The problem in plain English: encrypted in transit, every where at rest

§ 03 · THEARCHITECTURE The architecture: databases, media, backups, linked devices COMPONENT WHAT IT HOLDS · WHAT MATTER S