WhatsApp and chat exports as evidence: what a forensic examiner actually recovers

A large share of civil disputes now turn on instant messages rather than email: payment promises made in a chat thread, agreements reached over voice notes, harassment, fraud, and employment matters where the decisive exchange happened on a personal phone. WhatsApp remains the dominant platform in UK proceedings, and the evidence usually arrives as a screenshot or an export file. Those two artefacts are very different in evidential weight, and neither is what the underlying records actually are.

The three forms chat evidence takes

Screenshots. The weakest form. A screenshot proves only that at some point a display showed this content. There is no cryptographic binding to the account, the timestamp can be produced by any clock app, and message text can be assembled with basic image editing or with the very screenshot-editing features the app itself provides. Screenshots are routinely admitted, particularly where unchallenged, but they collapse under a serious challenge.

The in-app export. WhatsApp's "Export chat" function produces a text file of the message log plus, optionally, the media. This is the artefact most solicitors mean when they say they have "the WhatsApp records". It is richer than a screenshot: it carries each message with the phone-stored timestamp and the sending party's display name and number. But it is generated from the exporting device's local message database, not from the service. It is a rendering of what that one handset believes happened, produced by software the user cannot audit, and it omits things that matter: read receipts in usable form, deleted messages (with partial exceptions below), edits after the fact, and anything from a device that never synced.

The device and its databases. The strong form. WhatsApp on Android stores its message history in an encrypted SQLite database on the handset; on iOS, in the app's private container. A forensic examination of the phone, or of an iTunes/Finder backup under a known passcode, reads the database directly. That reveals the structure the export flattens away: message flags, edits and deletion markers, reply threading, and residues of deleted rows in unallocated database space and in freelist pages, which are frequently recoverable long after the user removed the message from view.

What end-to-end encryption does and does not mean here

Counsel regularly assumes that because WhatsApp is end-to-end encrypted, the messages cannot be forensically examined. This confuses transit with storage. Encryption protects the message in transit between devices. On the device itself the message exists in decrypted form in the local database, because the user reads it. A properly instructed examination of the device is therefore not fighting the encryption at all; it is reading the plaintext store. What encryption does prevent is casual interception and, more significantly, bulk retrieval from the service provider.

Where the real verification happens

WhatsApp can, under the UK Investigatory Powers Act regime and its US equivalents, produce certain records in response to lawful authority: account registration details, subscriber identifiers, and, critically, metadata about message events, while message content is not stored in readable form server-side. In a civil case this route is rarely available, so verification proceeds differently.

The examiner's approach is corroboration. The export or database is checked against the counterparty's copy of the same conversation: two independently held devices agreeing on message text and timestamps is far stronger than either alone. Timelines are cross-referenced against call logs, media capture times embedded in shared photos, and surrounding events. The database's internal consistency is examined, because editing a SQLite message store by hand tends to leave traces: sequence gaps, mismatched checksums, timestamps out of order. And media is examined in its own right; a photograph shared in the thread can carry EXIF that independently dates and places the exchange, a point we return to below.

What can still defeat you

• Disappearing messages. If enabled, messages are removed from the device store on schedule. The feature is discoverable from settings history and sometimes from database markers, but the content is genuinely gone unless a backup or the counterparty's copy holds it.
• Exported-then-edited text files. The .txt export is trivially editable. Without the device or the counterparty's copy, an edited export is nearly impossible to disprove line by line. This is why we treat exports as leads, not evidence, when a dispute is contested.
• Multi-device gaps. Linked desktop sessions and phone changes mean one party's history can silently diverge from the other's, particularly around the transfer window when migrating handsets.
• Media stripped of context. Voice notes are frequently decisive in payment disputes, and the export includes them only as attachments. Transcription and the audio file's own metadata both need attention.

Practical guidance for instructing solicitors

Preserve early. The single most common failure is a client "clearing space" on a phone that held the only intact copy. Advise clients in any live or foreseeable dispute to stop using disappearing messages, avoid changing handsets, and allow a forensic image or, at minimum, a full encrypted platform backup to be taken under supervision, following the chain-of-custody procedures that govern all device evidence.

Obtain the counterparty's copy at disclosure stage rather than assuming your own export settles it. Where the dispute turns on the authenticity of a document shared in the chat, the file's own metadata is the corroborating evidence, which is the territory covered in our article on what file metadata proves in litigation. And where the timeline rather than the content is contested, the surrounding phone records, call logs, backups and location artefacts usually resolve it more convincingly than the chat alone.

If you need a forensic examination of chat evidence for an ongoing matter, contact us directly. Initial case discussion is without charge.