WhatsApp and Viber evidence: what can each source establish?

Start with the question, the source and the authority

For a company, family office, legal adviser or private individual, the useful question is usually specific: was an instruction changed, does an attachment belong to this conversation, or does the available chronology support the reported sequence? Record the relevant participants, period, application and disputed point. Distinguish material seen personally from files forwarded by someone else. A screenshot received by email has a different collection history from an examination of the phone that displayed the conversation.

Confirm who may authorise access to each device, account and conversation before collection. Ownership of a company phone does not by itself resolve every question about access to personal communications. Agree scope, exclusions and recipients with the appropriate decision-makers and, where needed, legal advisers. The examination must stay within that authority; it is not a route to secretly accessing another person’s account.

Preserve the available state before attempting recovery

Keep the original device and the original files already available. Record when the issue was identified, the phone model, operating system and app version if known, who holds the device, and any actions already taken. Avoid reinstalling the app, resetting the phone, restoring a backup or running unverified recovery utilities before advice. These operations can change the material that needs examination. Preserve an existing export or screenshot as received; make separate copies for annotation or redaction.

There is no universal instruction to switch every phone off or leave every phone online. Power, lock state, synchronisation and remote changes create different preservation risks. SWGDE highlights that some accessible data can become unavailable over time or following a reboot. Ask an examiner to determine the handling plan for the actual device and circumstances. A preservation plan should record necessary changes as well as the reason for them.

Primary reference: SWGDE — Position on Timely Preservation via Digital Acquisition

Screenshots: useful visibility, limited source verification

A screenshot records pixels presented as a conversation. It can preserve visible wording, layout and a displayed time, but it does not by itself establish who operated the account, what preceded the image or whether the entire exchange is represented. A contact label may be locally chosen. A cropped picture can omit dates, reply context or participant details without showing why they are absent. These limitations do not make every screenshot false; they define what further checks are needed.

Keep the original image file, any available capture context and overlapping neighbouring messages. Record who captured it and how it reached you. Do not replace the original with an annotated PDF, a compressed forward or an OCR transcript. Those can be useful working aids, but they are derived versions. If a conclusion turns on a particular word, emoji, date or attachment, compare it with the original available display and source records within the authorised scope.

WhatsApp exports and backups serve different purposes

WhatsApp’s official export guidance distinguishes a text export from a backup that can be restored into the app. Its Android guidance offers export with or without media and states that the most recent media are attached when that option is selected. Do not infer that every historic attachment is present. Preserve the delivered package and document the platform, app version, export options, collection time and the first and last messages actually included.

For an existing backup, identify its date, account and accessible protection method before deciding how it could assist. WhatsApp’s encrypted-backup documentation describes password, encryption-key and passkey protection. Availability of a cloud account alone does not establish access to the backup content. Do not change protection settings or restore onto the original evidence device simply to test access. Export coverage and backup coverage must be checked separately; neither should be described as a complete forensic copy by default.

Primary reference: WhatsApp Help Center — exporting chat history · WhatsApp Help Center — end-to-end encrypted backups

Viber: separate chat backups from account-data downloads

Viber’s official guidance describes cloud backup and restoration, with photos and videos included only if selected. It states that chat history is platform-specific and cannot be transferred between Android and iOS, and warns that restoration returns the chat list to the backup state. These are reasons to document the existing state before restoring anything. A backup date alone does not prove that a particular message or attachment was included.

The Viber “Request your data” file is a different source. Viber explicitly states that chat content is not included in that account-data file. An account-data download must not be presented as a transcript of the conversations. Identify the actual material available: screenshots, data on an authorised device, an existing backup, or other properly obtained records. Check capabilities for that app and platform rather than assuming that WhatsApp and Viber offer equivalent exports.

Primary reference: Rakuten Viber — backing up and restoring chat history · Rakuten Viber — contents of a personal-data request

What an authorised device examination can add

A scoped examination can seek accessible application records and associated files, compare selected messages with the available source, and document how the result was obtained. The proposed acquisition method should match the device, operating system, app version, access state and question. A logical acquisition, an app export and a broader supported acquisition do not necessarily contain the same material. NIST’s mobile-forensics guidance describes the stages of preservation, acquisition, examination, analysis and reporting; it is not a promise of support for a current phone.

Ask which fields and sources were actually available and which checks were performed. A parser’s friendly display may need comparison with the underlying record when an identifier, timestamp or message relationship is disputed. Record tool versions and relevant limitations. Encryption, missing credentials, unsupported versions, retention and deletion can prevent access. An examination does not guarantee unlocking, recovery of deleted messages, a complete conversation history or identification of the person behind an account.

Primary reference: NIST SP 800-101 Rev. 1 — Guidelines on Mobile Device Forensics (2014)

Build a traceable evidence register and controlled working copies

Give each received item a stable reference. Record its source, collection or receipt time, custodian, original filename, size, transfer method and relevant acquisition notes. Where appropriate, calculate a cryptographic hash such as SHA-256 for the received package and the files selected for examination. State exactly which byte sequence the hash covers. Keep received originals separate from extracted files, converted images, transcripts and redacted reporting copies.

A matching hash supports byte-level consistency from the point at which it was recorded. It does not prove that a message was true, that an image was never edited before receipt, or that the collection is complete. Maintain a record of transfers, access and transformations. A useful report lets the reader move from a quoted message to its item reference and source location, and understand which version was examined.

Interpret time, conversation context and identity separately

Preserve a timestamp’s original value before normalising it. Identify whether it represents a message event, a displayed local time, an export operation or a file-system event. Record the known or assumed time zone and UTC offset for the relevant date; document clock uncertainty and daylight-saving considerations. File modification time is not automatically message-sending time. A time without a date or offset may be insufficient to establish ordering across sources.

Review surrounding messages, quoted replies, group membership context and attachment associations where available. A saved display name is not independent proof of identity. An attachment filename alone is not proof that the same bytes appeared on another device. Treat unexplained gaps, edited-message indicators, omitted media and disagreement between copies as questions to investigate. Do not label every inconsistency manipulation or assume that an absent recovered record proves a message never existed.

Specify deliverables that support a real decision

Agree an evidence inventory, acquisition and examination notes, a referenced chronology, selected message or media exhibits, and a limitations register. The chronology should distinguish original values from converted times and explain any assumptions. A finding should identify the question, the material examined, the check performed and the conclusion it supports. Where a point cannot be resolved, state what additional authorised source could help and whether obtaining it is proportionate.

An executive summary can explain the practical consequence while a technical appendix preserves reproducibility. Separate observed facts from interpretation and from information supplied by others. A translation or transcription is an additional derivative: keep it linked to the original and identify material uncertainty. Technical findings can inform legal advice, but admissibility, weight and procedural strategy depend on the relevant proceedings and are not guaranteed by a forensic report.

Arrange a secure handover with TRUST-IT

For the initial enquiry, describe the application, the device type, the broad issue, the date range and the decision deadline. State whether you hold the original device, screenshots or an existing backup and whether you are authorised to request examination. Do not upload conversation evidence, identity documents, passwords, recovery codes or encryption keys through an ordinary website form or public chatbot.

TRUST-IT can assess the available sources and agree a suitable examination scope and secure transfer method. Before handover, clarify named recipients, access restrictions, receipt confirmation, reporting format and retention or return arrangements. The agreed scope should identify what can be checked with the available material and what remains outside it. If only screenshots remain, a limited assessment can still identify useful questions without presenting unseen source data as verified.

Platform documentation checked on 4 November 2026. Features can change by version and platform. NIST 2014 is a methodological reference, not a current-device capability list. Technical source guidance does not determine legal admissibility. Editorial photographs are AI-generated illustrations, not client evidence or photographs of a TRUST-IT engagement.

Further reading

• WhatsApp Help Center — exporting chat history
• WhatsApp Help Center — end-to-end encrypted backups
• Rakuten Viber — backing up and restoring chat history
• Rakuten Viber — contents of a personal-data request
• NIST SP 800-101 Rev. 1 — Guidelines on Mobile Device Forensics (2014)
• SWGDE — Position on Timely Preservation via Digital Acquisition

Put the guidance to work

Forensic examination of computers, phones, storage media and backups, with documented acquisition, timelines and evidence limitations.