Technical examination of WhatsApp, Telegram and other app conversations: authenticity, integrity, authorship and deleted messages, from the challenged screenshot to hash-verified extraction.
App conversations decide employment claims, family disputes, criminal cases and electoral cases. And in most case files they arrive in the most fragile form possible: a screen capture.
A screenshot is a photograph of a screen, not the conversation. It carries none of the app's internal records, it allows no integrity check and it does not show which device it came from. Everything a screenshot displays can be reproduced by anyone who knows how to stage the screen.
In a real electoral case examined by the laboratory, a candidate filed PDFs containing screenshots of supposed group conversations. The forensic examination reproduced the screens in full within minutes, using ordinary devices and no special tooling, and the report declared the fraud: the screenshots themselves contained the traces of the staging.
That is why the right question is not "does the screenshot look genuine?", but "what supports this screenshot?". The answer is technical, and it has a hierarchy.
The staging demonstrated in the electoral case followed four steps within reach of any user:
The very mechanics that make the fraud possible leave the traces that expose it:
Where the fraud is evident in the staging itself, the examination can declare it without access to the source device: that is what happened in the electoral case. To certify that a conversation is authentic, however, the opposite route, the examination needs the source: the device, or a forensic extraction from it.
An image of what the screen displayed at one instant. Reproducible in minutes, with no metadata and no verifiable integrity. It may be accepted where it is not challenged; once contested, it is the most fragile rung.
The native export chat feature generates a file with the history and the media. Better than a screenshot, because it brings structure and continuity, but the file is editable text, with no hash and no chain of custody: it documents, it does not authenticate.
Acquisition of the app databases directly from the device, using a forensic tool, SHA-256 hashing, sealed media and a documented chain of custody. This is the rung that carries metadata, internal records and any surviving deleted messages, and that withstands challenge.
In short: the screenshot shows, the export organises, the extraction demonstrates. Where the conversation is central to the case, moving up a rung before it is challenged costs far less than arguing about its fragility afterwards.
The examination verifies whether the messages appear in the app's databases on the device, with their internal records and identifiers: the difference between an image of a conversation and a conversation demonstrated.
A hash calculated at acquisition and verifiable at any time, by either party: if one bit changes, the hash gives it away. It is the objective criterion for the integrity of digital evidence.
The link between message, account, number and device, combined with the context in which the device was used: who was behind the conversation, supported by traces rather than by the appearance of a screen.
Surviving records of deleted messages in the app databases or in residual areas of the device, where recoverable: including the demonstration that something was deleted, and when.
The examination also works as counter-evidence: faced with screenshots filed by the opposing party, comparison against an extraction from the device shows whether that conversation existed, whether it was edited, or whether it was never there at all.
The case law of the Brazilian Superior Court of Justice (STJ) draws a double standard. On one side, screenshots produced voluntarily by private parties have been admitted where they are confirmed in court, subject to adversarial debate, and with no sign of tampering: the chain of custody regime of CPP, arts. 158-A to 158-F (Brazilian Code of Criminal Procedure) is addressed primarily to traces collected by the State.
On the other side, the standard tightens where method is absent or the evidence is contested: in AgRg in HC 828,054/RN (5th Panel, 2024), screenshots taken from a seized phone with no forensic tool, no hash and no documentation were held inadmissible.
The 6th Panel has likewise reaffirmed the invalidity of evidence obtained by mirroring conversations through WhatsApp Web, a means that allows a third party to send and delete messages in the user's name; and, in HC 943,895/PR (5th Panel, 2025), access to the device before the forensic examination rendered the evidence unusable.
The practical reading: a conversation may enter the case file by several routes, but the moment it is challenged, the outcome starts to depend on technical demonstration. Extraction with hashing, carried out early, spares the case that argument altogether.
While the examination is still pending, some behaviours preserve evidential value, and others destroy it:
See also
Forensic Extraction from Mobile Phones → Digital Questioned Document Examination → Computer Forensics → Expert Reports and Opinions →
The base is São Paulo; the reach is nationwide. Depending on the case, collection takes place at the laboratory, on site (an office, a company, a notary's office or a courthouse) or through an assisted remote procedure, under the same procedure of hashing and documented chain of custody.
A device at risk of remote wiping, an imminent procedural deadline or evidence about to expire: urgent preservation cases receive priority triage through the business WhatsApp line, including outside the standard response flow.
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case