Conversation reconstruction
Available individual and group messages, replies, reactions, edits, delivery states and system events reconstructed in context.
Messaging application evidence
WhatsApp
Forensics.
Forensic examination of WhatsApp communications, calls, media, accounts and associated artefacts across available devices, linked computers and backups.
Discuss a deviceExamination
What we can
establish.
Every instruction begins with the questions to be answered. Available evidence depends on the device, software, state, credentials, backups and prior handling.
Media & documents
Images, video, audio, documents, thumbnails and cached copies assessed with available metadata and file-system traces.
Calls, contacts & groups
Call records, identifiers, group membership, administrators, profile changes and account events correlated with other evidence.
Deleted-message assessment
Database remnants, notifications, quoted replies, media, backups and counterpart devices examined without promising deleted-data recovery.
Backups & linked devices
Available cloud or local backups, WhatsApp Web and desktop artefacts considered to extend or corroborate the handset record.
Authenticity & attribution
Claimed conversations tested against databases, internal identifiers, timestamps, account activity and surrounding device artefacts, not screenshots alone.
Evidence source map
Beyond the
visible application.
Absence from one screen or device does not resolve the evidential question. Relevant records may be distributed across several sources.
Local records
Accessible chat databases, calls, identifiers, attachments, media and database remnants.
Backup and account
Configured iCloud or Google application backup, with encryption material where required. Authorised linked-session collection is a separate, state-changing route.
Existing linked endpoints
Existing WhatsApp Desktop or Web data may hold only synchronised history.
Limits and corroboration
A newly linked session is not a historic archive. Linking may notify the account holder and alter state. Lawfully obtained counterpart records may corroborate the source.
Evidential perspective
A screenshot is a representation, not the whole record.
End-to-end encryption protects messages in transit. It does not remove every trace from participating devices, linked systems or backups. The forensic question is what records remain, who controlled the relevant account and whether the material reliably supports the asserted conversation.
Preserve now
Protect the
best evidence.
- 01Do not reset, update, reinstall or casually browse the application.
- 02Record the device, lock, power and network state.
- 03Identify backups, linked computers and counterpart devices promptly.
- 04Secure known credentials separately and maintain custody records.
Typical deliverables
Acquisition record
Device details, condition, method, tool, integrity information and material acquisition limitations.
Evidence schedule
Relevant conversations, attachments, timestamps, identifiers and supporting artefacts in a reviewable form.
Findings report
Plain-English findings with source references, alternative explanations and express evidential limitations.
Our approach
Proportionate.
Documented.
Explainable.
- 01Authority, objectives and device state confirmed.
- 02Acquisition method selected to preserve the best available evidence.
- 03Findings correlated and tested against alternative explanations.
- 04Clear reporting of methodology, findings and limitations.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- WhatsApp linked-device history
Linked endpoints may receive only part of the history.
Platform documentation · Documentation checked
- WhatsApp linked devices
Linking is an account operation, not a passive historic archive.
Platform documentation · Documentation checked
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
