Can WhatsApp Be Used as Evidence? The Legal Process and Digital Forensics

TL;DR: WhatsApp messages can be accepted as evidence in Turkish courts, but what is decisive is not the content, it is how the message was obtained. A screenshot taken from a phone is, on its own, very weak evidence from a legal standpoint, because it can easily be manipulated with Photoshop or similar tools. By contrast, when the msgstore.db.crypt14 database extracted directly from the device through forensic methods, the key file and the device artifacts are combined, they form an evidence package that is hard to refute in court. Because WhatsApp is end to end encrypted (E2E), message content does not exist on Meta's servers, only metadata does. For this reason, the only way to reach a plaintext message is the user's device or a cloud backup.

Does a Screenshot Count as Evidence?

In Turkish law, Articles 199 to 201 of the Code of Civil Procedure (HMK) interpret "document" broadly: all written, printed and electronic records count as documents. So in principle a screenshot can be submitted to a case. The problem is that admissibility is not enough; the judge looks at the probative value of the evidence.

A screenshot is pixel data carrying a name, a profile photo, a bubble color and a timestamp. To prove that this image has not been altered, there is no hash signature, no metadata captured at the moment of the screenshot, and no independent witness. Before the judge, opposing counsel can refute it in two sentences: "This image was not taken from my client's device but from the plaintiff's own device, and it is open to manipulation." For this reason, for a screenshot to survive legally, an expert report is needed, preferably an expert opinion obtained within the framework of CMK Articles 67 to 73.

Why Is WhatsApp a Different Situation?

WhatsApp uses end to end encryption based on the Signal Protocol. This means the message is encrypted on the sender's device, the server cannot read the content while it passes through Meta's infrastructure, and it is decrypted only on the recipient's device. As is also stated clearly in the Meta Transparency Reports, the company does not store message text, photos or voice recordings. Only metadata is kept: which number communicated with which number, on what date and time, over which IP, and for how long.

This architecture moves legal evidencing to a point entirely different from telecommunication records. There are three possible locations where the plaintext, that is the readable message content, can be found:

  1. The sender's device
  2. The recipient's device
  3. An iCloud or Google Drive backup

Outside these three points, nowhere else in the world does the cleartext version of that message exist. The direction of forensic work points toward one of these locations.

How Is Proper Evidence Collected?

The Device Is Physically Obtained

On Android, the WhatsApp database is kept encrypted at the path /sdcard/WhatsApp/Databases/msgstore.db.crypt14. To open this file, the /data/data/com.whatsapp/files/key file (or key-encrypted in newer versions) must be acquired together with it. Without both, decrypting the database is nearly impossible. Tools such as Cellebrite UFED, Magnet AXIOM or Oxygen Forensic Detective perform this extraction without breaking the chain of custody, in accordance with the ISO/IEC 27037 standard.

On iOS, WhatsApp data resides inside the application's iTunes/Finder backup. If the backup is password protected and the password is unknown, brute force or Magnet AXIOM's iOS backup parser module comes into play in the forensic environment. In cases where a backup cannot be made, physical imaging is still technically possible for older iPhone models that benefit from the checkm8 vulnerability.

No Device, but a WhatsApp Web Session Exists

If the other party's WhatsApp Web session cookie (session.json, IndexedDB, LocalStorage) is active on a computer, the conversations open at that moment can be seen. The critical rule here is to work on the live system. If the computer is shut down, the session is lost. For this reason, on site, a mirror copy of the browser profile must be taken together with a memory dump. The SHA-256 hashes of the captured records are entered into the record.

Only a Cloud Backup Exists

The Google Drive backup has had an optional end to end encrypted storage option since late 2023. If the user has enabled this feature, the backup cannot be decrypted even with a court order served on Google; the user's 64 digit key or WhatsApp password is required. For an iCloud backup, the Apple ID password or iCloud Keychain access is essential. Since unencrypted classic backups are still the majority, the most practical source for forensics is Google Drive.

The Legal Request Route to Meta

The procedure to be followed in applications made to Meta by Turkish prosecutors or an authorized court order is defined clearly on the official WhatsApp law enforcement request portal. Requests coming from foreign authorities proceed through the MLAT (mutual legal assistance) chain and can take months. As a result, Meta provides only subscriber records (number, registration date, last login IP), connection logs and device type. Message content is, technically, never provided under any circumstances, because it does not exist at Meta.

Which Courts Accept It?

There are four main types of court where WhatsApp messages are accepted:

Family court: Widely used in divorce cases for matters such as breach of fidelity, insult, threats and intent to conceal assets. The judge's discretion is broad, but opposing counsel's objection to a screenshot is strong.

Labor court: Used by an employer or employee in claims of just cause termination, in performance correspondence, and in mobbing claims.

Criminal court: In crimes such as threats, blackmail, insult, fraud and organizational communication, evidence is assessed within the framework of the CMK. Here the prohibition on illegally obtained evidence is applied most strictly; a message obtained by accessing someone else's device without permission will most likely cease to be admissible.

Commercial court: Because commercial communication such as order confirmation, intent to contract and preliminary agreement now largely runs over WhatsApp, commercial judges are by now familiar with these messages.

In all four court types, the acceptance rate of a screenshot submitted without a forensic report drops markedly. The presence of a report dramatically increases the probative value of the evidence.

The Opposing Party's Objection Scenarios

A forensic report is designed to break the opposing party's classic line of objection:

  1. "I did not write these messages, they are fake." The row ID in the SQLite table, the send timestamp and the device ID from the device extraction refute this claim.
  2. "The context has been changed, it has been cut and edited." When the full thread, the preceding and following messages, and a complete timeline are presented, the context defense collapses.
  3. "The device was in someone else's hands at that time." This is answered by cross reading the device's location data for that time window, the base station record, the IMEI and the active user session.
  4. "The message was deleted, it has been manipulated." The trace of deletion and alteration is shown through the SQLite WAL log, the write ahead journal, and a Google Drive snapshot comparison.

A report prepared along these four axes takes on the character of a written defense in court.

Can a Deleted WhatsApp Message Be Recovered?

In the vast majority of cases, yes. It can be recovered through several different routes:

First, the last Google Drive backup before the user deleted the message usually still exists. WhatsApp takes a backup daily or weekly by default. If the message was deleted after the backup was taken, it is restored from the backup.

Second, on iOS, iCloud backups work in a similar way.

Third, when the physical device is in hand, the WAL (write ahead log) and journal files of the SQLite database still hold some of the deleted rows. Tools such as Magnet AXIOM extract these artifacts with the "Recover deleted records" operation.

Fourth, if the recipient's device is preserved, even if the "delete for everyone" feature was used, a trace can be found in the notification center remnants, the feedback metadata and the push notification archives.

The "I Deleted This Message, No One Can See It" Fallacy

When a message is deleted, it disappears from the sending device. However, copies of that same message remain at other points:

  • If "delete for everyone" was not done on the other party's device, or the time window has passed, the message remains in its original form.
  • Traces may remain in the web client's cache, in the IndexedDB database.
  • The automatic cloud backup taken that day contains the message.
  • In corporate use, if there is a WhatsApp Business API integration, a server record belonging to the company exists. This record creates a retention obligation for the data controller under KVKK.

In other words, the belief that "I deleted it, it is over" is technically wrong. Forensics often has a scenario that can still work even after deletion.

The KVKK Dimension

The KVKK regulation affects the matter of WhatsApp evidence in two ways. First, the administrator of a WhatsApp group can in some cases be considered a data controller and carries obligations for the personal data of group members. Second, a message taken from someone else's phone without permission can give rise both to a breach of special category data under KVKK Article 6 and to the offense of violating privacy under Article 134 of the Turkish Penal Code (TCK).

Article 12 of the KVKK governs the data security obligation. The measures a company takes when backing up its corporate WhatsApp messages form the basis of the chain of evidence in any future dispute. Article 28 of the KVKK lists the exceptions; in investigation, prosecution and adjudication processes, the processing of personal data is possible in a limited way. So sharing message data in a judicial process is not a KVKK violation, but the framework of that sharing is drawn by a court decision.

What Should the Lawyer Do?

So that the evidentiary value of the messages can be preserved, on the first day the lawyer should tell the client these four points:

  1. Do not view the screenshot as evidence on its own. Keep it if it was taken, but do not build a file on it alone.
  2. Do not touch the device, do not reset it to factory settings, and do not reinstall WhatsApp. The device must be handed to the forensic expert as it is.
  3. Turn off cloud backup synchronization. Taking a new backup can cause evidence deformation on the existing backup.
  4. Coordinate with a forensic expert at an early stage. An expert opinion should be requested within the framework of CMK Articles 67 to 73, and if necessary a court order should be sought for the seizure of the device.

These four steps minimize the risk of the evidence being lost before trial.

Frequently Asked Questions (FAQ)

Can a WhatsApp screenshot be evidence on its own?

It can be submitted legally, but its probative force is weak. The opposing party can simply raise the "it has been manipulated" objection. Unless it is supported by an expert report, it is mostly not enough to ground a judgment on its own.

What happens if the other party says "I did not write it"?

To refute this objection, technical layers of evidence such as device extraction, SQLite records, IMEI and session logs are needed. Without a forensic report, denial most likely works.

Can a deleted WhatsApp message be recovered?

In most cases, yes. The cloud backup, the SQLite WAL log, the other party's device or notification archives are possible sources.

Can it be used without an expert report?

It can, but the judge's discretion is very broad and the acceptance rate is low. Obtaining an expert opinion within the framework of CMK 67 to 73 is strongly recommended.

If the cloud backup is encrypted, can you read it?

If WhatsApp's end to end encrypted backup feature is active, the content cannot be decrypted without the 64 digit key or the user's password. Classic backups, on the other hand, can be decrypted with a court order.

Can metadata be obtained from WhatsApp?

Yes. In line with a court order, Meta shares subscriber records, the last login IP, the registration date and connection logs. Message content cannot technically be provided, because it does not exist in the company's infrastructure.

Working with DSET

The proper collection of encrypted communication data such as WhatsApp evidence is one of our team's standard areas of work. We covered the process in our pillar article The Digital Forensics Process 2026 along the axes of KVKK, the chain of evidence and court integration. The ISO/IEC 27037 standard, the HMK document regime and the CMK expert opinion mechanisms referenced in that article also form the legal framework of our WhatsApp specific work.

In scenarios where the device is in hand, where only the cloud backup remains, or where only the other party's device can be reached, we follow different technical paths. In every case the priority is full content extraction without compromising the integrity of the evidence.

Hacettepe Teknokent Ankara Phone: +90 536 662 38 09 Email: [email protected]

Sources: CMK, HMK, KVKK, ISO/IEC 27037, official WhatsApp law enforcement request portal, Meta Transparency Reports.