Threats, verbal agreements confirmed by message, insults, requests for money: more and more often the key conversations in a dispute are found in a messaging app. WhatsApp is the most widespread, but the same considerations apply to Telegram, Signal, Messenger and similar apps. Preserving them in a way that withstands challenge takes a little more care than a simple screenshot.
The underlying problem
A chat exists in complete form on the sender's device, on the recipient's device and sometimes in a cloud backup. Everything else, screenshots, exports, printouts, is a representation of that data. The further the representation moves from the original, the easier it is to challenge.
It is also worth remembering that there are apps and websites that generate fake conversations, with names, profile pictures and times chosen at will. A simple image of a chat therefore does not, on its own, prove that the conversation took place.
The options, from weakest to strongest
| Method | Advantages | Limits |
|---|---|---|
| Screenshot | Immediate, readable | Easy to challenge, partial context |
| Chat export | Full text and attachments | Editable file, limited metadata |
| Video of scrolling on the phone | Shows the real app and continuity | Does not contain internal data |
| Forensic device acquisition | Access to the app database | Requires tools and expertise |
Screenshots
If they are the only option, do them well: capture the whole conversation without skipping messages, include in each screenshot the header with the contact's name and number, and do not crop. A screenshot of the contact card showing the full phone number is also useful.
Export
The app's export function produces a text file with the messages and, optionally, the attachments. It is more complete than screenshots, but the text file can be edited with any editor. It should therefore be accompanied by a hash calculated right after the export and by documentation of how it was done.
Scrolling video
Recording the chat being scrolled inside the app, with a second device or with screen recording, shows that the messages really are in that app, on that phone, in a continuous sequence. It is a simple method that non-technical readers can understand.
Forensic acquisition
This is the most robust solution. Extracting the device gives access to the database where the app stores messages, with internal identifiers, precise times, delivery and read status, and any deleted messages still present. It also allows checking consistency between what appears on screen and what is recorded internally.
How authenticity is verified
When a chat is challenged, analysis focuses on a few points:
- internal consistency: times are progressive, message identifiers are in sequence, there are no unexplained gaps;
- consistency across devices: if the other party's phone is also available, the messages must match;
- consistency with other data: notifications, system logs, backups;
- no traces of manipulation: fake-chat apps installed, changes to the database, altered system clock.
Deleted and edited messages
Many apps let you delete a message for everyone or edit it after sending. In some cases traces remain: a "message deleted" note, a notification received before deletion, fragments in the database. Recovery is never guaranteed and depends on the device, the app version and the time elapsed. Acting early improves the odds.
Common mistakes
- Deleting the chat after exporting it: you lose the original, which is the strongest source.
- Changing phones without keeping the old one: transfers do not always carry all the data.
- Forwarding messages: a forwarded message loses information about the original sender and time.
- Uninstalling and reinstalling the app: this can overwrite useful data.
- Relying only on the backup: backups can be partial or encrypted in ways that are not accessible.
What to do right away
- Do not delete anything and do not change the chat.
- Turn off disappearing messages, if enabled.
- Take complete screenshots as a first safeguard.
- Export the chat with attachments and note the date and time.
- Keep the phone, even if you plan to replace it, until a forensic acquisition has been considered.
In short
- A chat screenshot is easy to challenge and to fake.
- Exports and scrolling videos strengthen the documentation.
- Forensic acquisition of the device is the most robust method.
- Authenticity is assessed through internal, cross-device and external consistency.
- Do not delete, do not forward, and keep the original phone.