What We Examine
Messaging AppsWhatsApp, Signal, Telegram, Messenger and iMessage, including group chats and attachments.
Social PlatformsFacebook, Instagram, Snapchat, TikTok and X posts, comments and direct messages.
Account DownloadsData exports provided by the platforms, analysed alongside device evidence.
Disappearing and Deleted MessagesRecords that remain after messages are deleted or set to expire.
ScreenshotsComparison of screenshots with the original data to test whether they are complete and unaltered.
Account AttributionLinks between an account and a person or device, and the limits of that link.
When It Matters
- →Harassment, threats and stalking
- →Domestic violence and protection order breaches
- →Defamation and online abuse
- →Family law matters relying on chats
- →Employment matters involving messages between staff
- →Criminal defence where messages form part of the brief
Screenshots Are Not Enough
A screenshot can be cropped, edited or taken out of context, and courts increasingly expect more. Where the original data is available, we compare it with the screenshot and report whether the screenshot is a complete and accurate record.
Reviewing an analysis prepared by police or another expert? See disclosure and case review.
Related Guides
- →Screenshots Aren’t Evidence Until They’re Authenticated
- →Capturing Digital Evidence Properly
- →Can Deleted Text Messages Be Recovered for Court?
Common Questions
Can you prove who was behind an anonymous account?+
Sometimes. Devices, logins and account data can link an account to a person, but the strength of that link varies. We report exactly how strong it is.
Can deleted Snapchat or disappearing messages be recovered?+
Occasionally, depending on the app, the device and how much time has passed. We advise on likely outcomes before you commit.
Are screenshots I took myself useful?+
Yes, as a starting point. Keep the original device and account too, as they allow the screenshots to be verified.
Before You Call
01Stop Using the DeviceNew messages, app updates and photos can overwrite deleted data. Leave it as it is, keep it charged, and don't let anyone "have a look" first.
02Don't Delete, Reset, Wipe or UpdateA factory reset or removing apps can make recovery impossible, and deleting material can count against you in court. Don’t install operating system or app updates either: an update can overwrite deleted data and change what can be extracted.
03Isolate It If It Could Be WipedIf someone else could remotely lock or erase the device, switch on flight mode. Ask us before powering it off.
04Write Down What You KnowKey dates, what you need to establish, and any passcodes. It lets us scope the work accurately on the first call.