How to preserve WhatsApp messages as evidence

Why are WhatsApp screenshots weak evidence?

Because a screenshot is an image, and an image can be fabricated or retouched without leaving a visible trace. Any photo editor can change a word, a time or a name, and an entire fake conversation can be built from scratch.

Screenshots also have three built-in gaps:

• They show a fragment. What was said before and after is missing, so the other side can argue the context was cut.
• They carry no message data. You see the name you saved for the contact, not the phone number, and often not even the full date.
• They have no reliable date of their own. An image file's date changes when it is copied or forwarded.

That does not make screenshots useless. They help explain what happened and are often accepted when nobody disputes them. The trouble starts when the other side says they were edited. At that point you need something sturdier.

How do you export a full WhatsApp chat?

WhatsApp has a built-in feature to export an individual or group conversation. Menu names shift slightly between versions, but the path is:

1. Open the conversation you want to keep.
2. On Android, tap the three-dot menu, then "More", then "Export chat". On iPhone, tap the contact or group name and scroll down to "Export chat".
3. Choose whether to include media or export without it.
4. Send the result somewhere you control: your own email, your cloud storage or the phone's storage.

The result is a plain text file (.txt) with one message per line: date, time, sender and content. If you include media, the photos, voice notes and documents come with it, usually bundled together in a .zip archive.

Exports are capped at a certain number of messages, and the cap is lower when media is included. For a long conversation, open the .txt and check that it reaches back to the date you need. If it does not, export a second copy without media.

What should you keep besides the exported file?

The phone and the original conversation. The export is a plain text copy, and plain text can be changed in any editor. What lets someone confirm the copy is faithful is the device where the messages still exist.

• Do not delete the chat, and turn off disappearing messages for that conversation.
• Do not uninstall WhatsApp or change your number without backing up first.
• If you replace the phone, keep the old one and do not factory reset it.
• Store the exported file exactly as it came out. Do not open it and save it again, and do not rename what is inside the archive.

What do a hash and a trusted timestamp add?

Two things the file lacks on its own: integrity and a verifiable date.

A hash (SHA-256) is a code calculated from the contents of the file. Change a single character in the chat and the resulting hash is different. A trusted timestamp is a statement issued by a third party, a time-stamping authority, that signs that hash together with the date and time under the RFC 3161 standard. The mechanics are covered in what a trusted timestamp is.

Together they let you show that this exact file existed on that date and has not been modified since. That is why it pays to do it right after exporting: the shorter the gap between export and timestamp, the less room there is to argue about tampering.

You can do this with Certify WhatsApp chat. The hash is calculated in your browser, so the chat is not uploaded to a server, and you get a certificate that anyone can check on the verification page.

What does a certified chat not prove?

It does not prove who wrote the messages or that what they say is true. It also does not prove the file matched the conversation before it was timestamped: the timestamp covers the state of the file from that moment forward, not its earlier history.

The name shown in the export is the one you gave the contact in your address book. Tying that name to a real person takes other evidence: the phone number, an admission, witnesses, or a forensic examination of the device. A certificate does not guarantee legal value and does not replace a notary or an expert.

What do courts look for in chat evidence?

Broadly, four things: integrity (it was not altered), date (when it happened), origin (which device and account it came from) and context (the conversation is complete enough to be understood).

The rules differ by country and by type of case, whether employment, family, civil or criminal, and admissibility and weight are decided by the judge each time. If the chat is going to be central to your case, talk to a lawyer before you submit it. They can tell you which format and supporting material your court expects.

When do you need a notary or a forensic expert?

When the other side is likely to deny the conversation, when a lot is at stake, or when the matter is criminal. In those situations a hash and a timestamp are a good starting point, but they are not enough.

• Notary or equivalent official: in some countries a notary can record what was shown on your phone's screen at a given moment. How far that record goes depends on local law.
• Digital forensics examiner: extracts the data from the device with forensic tools, checks for signs of manipulation and writes a report they can defend in court.
• Police: for threats, extortion or harassment, report it and hand over the phone as instructed, without touching the conversation first.

Step-by-step checklist and common mistakes

1. Delete nothing, and turn off disappearing messages in the chat.
2. Export the whole conversation, with media if photos or voice notes matter.
3. Check that the .txt covers the full period you care about.
4. Hash and timestamp the file the same day.
5. Keep two copies of the original file in different places, along with the certificate.
6. Write down the other person's phone number and the name you saved it under.
7. Hold on to the phone until the matter is over.

The mistakes that weaken this kind of evidence are predictable:

• Editing the .txt to tidy it up or remove irrelevant parts. That changes the hash and invites claims of tampering.
• Exporting only the days that favor you. A trimmed chat opens an argument about context.
• Submitting screenshots alone and deleting the chat to free up space.
• Forwarding the file through apps that compress or convert it, then keeping that copy instead of the original.
• Waiting months before fixing the date.