WhatsApp Evidence

WHATSAPPEVIDENCE · AGUIDEFORUKLAWYERS WhatsApp Evidence Databases, Backups, Deleted Messages, Groups and Linked Devices: the App That Runs UK Business on the Side COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM BACKUP & DELETED-DATA ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: encrypted in transit, everywhere at rest 03 The architecture: databases, media, backups, linked devices 04 Deletion: for-me, for-everyone, and what each leaves 05 Groups: multiplied evidence, multiplied duty 06 Disappearing messages and the preservation race 07 Authentication: threads, exports and the screenshot problem 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : WHATSAPP ' SENCRYPTIONGUARDSTHEWIRE , NOTTHEENDS : ANDLITIGATIONLIVESATTHEENDS § 0 2 · FIRSTPRINCIPLES The problem in plain English: encrypted in transit, everywhere at rest § 0 3 · THEARCHITECTURE The architecture: databases, media, backups, linked devices COMPONENT WHAT IT HOLDS · WHAT MATTERS § 0 4 · WHATDELETIONLEAVES Deletion: for-me, for-everyone, and what each leaves § 0 5 · GROUPS Groups: multiplied evidence, multiplied duty § 0 6 · THERACE Disappearing messages and the preservation race § 0 7 · ISITREAL ? Authentication: threads, exports and the screenshot problem § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BACKUP PRIMARY COMPUTER LINKED COUNTERPART DELETED / DEVICE (FFS) BACKUPS DEVICES PARTICIPANTS RECOVERABLE CLOUD LINEAGE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEDELETE - FOR - EVERYONETHATDATEDITSELF EXAMPLE2 · THEGROUPTHATOUTVOTEDTHEWIPEDPHONE EXAMPLE3 · THESCREENSHOTTHREADTHATNEVEREXISTED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · W H AT SAPPLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The WhatsApp checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can WhatsApp itself give us the messages? Messages were deleted months ago. Realistic prospects? Are WhatsApp messages even admissible: aren't they hearsay? The other side produced a chat export. Do we accept it? Our client screenshot everything and deleted the originals "to save space". How bad? Do we need every group member's phone? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY