Evidential scenario
An employee deleted WhatsApp before resigning
The immediate issue is preservation across the company phone, employee-held devices, backups, linked computers and recipients, followed by a proportionate assessment of what deletion can actually be proved.
Questions to resolve
Establish the fact base.
Who owns and controls each device and account?
When was deletion suspected and how was it discovered?
Were company backups, desktop clients or MDM records retained?
Immediate actions
Preserve the available routes.
Preserve company devices and relevant accounts
Suspend routine wiping and recycling
Identify counterpart and linked-device evidence
Agree legal scope with counsel
Interpretation risks
Avoid premature conclusions.
Continued use overwriting residual evidence
Overstating deletion from an absent chat
Unlawful access to personal accounts
Confidential case review
