Mobile evidence guidance
Can a WhatsApp screenshot be authenticated?
A screenshot can be assessed, but it is only a representation. Stronger authentication compares it with the underlying application database, message identifiers, media, notifications, backups and the other participant’s device.
Potential evidence sources
Where relevant records may exist.
- Original screenshot file and metadata
- Source device and WhatsApp database
- Referenced media and attachments
- Chat export with provenance
- Backup and linked-device records
- Counterpart device
Decision factors
What materially changes the prospects.
- 01Whether the original file is available
- 02Visible inconsistencies in layout or timestamps
- 03Matching message identifiers and attachments
- 04Device and account ownership
- 05Completeness of the surrounding conversation
Evidential limitations
What must not be overstated.
A visually convincing screenshot can still be fabricated
Metadata alone rarely proves message content
Authentication and sender attribution are separate questions
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
