Business Growth & Digital Solutions: WhatsApp Chats as Evidence in Pakistan: Preservation and Authenticity

Begin with the fact the conversation is supposed to establish

Before collecting a large chat history, write down the issue in plain language. A finance team may need to know whether an employee approved a payment. A supplier may need to establish which delivery date was agreed. An HR team may be investigating a threatening message. A professional may need to show that a client supplied particular information. These questions should guide collection and review.

Take an apparent approval reading “Please proceed.” The message may look decisive until the earlier exchange reveals that it referred to obtaining a quotation rather than releasing funds. A quoted reply, an attachment or a later clarification may change its meaning. The question should therefore be framed around the actual decision and the relevant context, not around finding a short sentence that supports one side.

Identify the connection between the message and the person or organisation whose conduct matters. Was the sender using a personal number or a business account? Did they have authority for the decision? Was the recipient entitled to rely on that channel under the contract or company process? Evidence that a message was sent is only one part of a dispute about whether it created a binding commitment.

A focused issue statement also supports proportionate handling of personal data. If the matter concerns one project over a defined period, counsel can consider how much surrounding material is needed and which sources to preserve. Broad preservation may sometimes be justified, but routine circulation of an employee’s entire personal chat history is not an appropriate default simply because a work-related message appears within it.

Separate authenticity, attribution, meaning and truth

Authenticity asks whether the material is what it is claimed to be. For example, does a file accurately represent a conversation captured from the identified device? Attribution asks who was responsible for the communication. Meaning asks what the words conveyed in context. Truth asks whether a statement within the conversation accurately describes an external event. Those questions are connected, but they are not interchangeable.

A genuine message saying “The goods have arrived” may establish that the sender made that statement. It does not necessarily establish delivery. The sender may have been mistaken, repeating someone else’s information or referring to a different shipment. Warehouse records, delivery acknowledgements and the next messages may be needed to determine what happened. Treating every authentic message as a true account of the world would produce unreliable conclusions.

Similarly, a faithful screenshot from a recipient’s phone does not independently prove that the named contact personally typed the message. The display name may have been chosen by the recipient, a business account may be shared, or access may be disputed. These possibilities should be investigated based on evidence. They are neither automatic reasons to reject a chat nor reasons to assume its authorship.

During review, label the proposition each item supports. One screenshot may support the sequence of a conversation; a signed contract may establish authority; a bank confirmation may establish payment; a witness may explain the circumstances. A clear evidence file shows how those items work together. It avoids demanding that a single screenshot answer every question in the case.

Pakistan’s legal framework recognises electronic form without removing proof requirements

The Electronic Transactions Ordinance 2002 provides legal recognition for electronic documents and addresses matters such as writing, originals, retention and electronic signatures. Electronic form alone is not a reason to deny the legal recognition described by the Ordinance. The provisions contain conditions and should be read with the kind of document and transaction involved. See the official ETO text, particularly sections 3–9 and 13–15.

For an electronic record offered as an equivalent to an original, integrity and the ability to display the information are important statutory concepts. Retention also concerns accessibility and relevant information about origin, destination and timing. These rules support disciplined preservation. They should not be reduced to the claim that printing a chat automatically gives it every quality of an original record or proves the identity of its author.

The Qanun-e-Shahadat Order contains provisions relevant to electronic documents and expert opinion. Article 59 addresses relevant expert opinion in its specified fields, including electronic-document authenticity and integrity. Article 164 was amended in 2023 to address evidence and witness recording through modern devices and techniques. The 2023 Gazette, section 12, is the appropriate source for that amendment rather than an outdated quotation circulating online.

Those provisions do not create a rule that every WhatsApp screenshot is conclusive. Relevance, source, context, reliability and the applicable procedure remain important. Nor should Pakistan advice import an Indian certificate requirement or a foreign court practice without a Pakistani legal basis. Counsel should identify the actual rules governing the proceeding and explain how the evidence will be introduced and tested.

Keep questions of legal effect separate as well. A message can be relevant to negotiations without satisfying every requirement for a particular agreement or notice. A typed name is not automatically proof that a person authorised a transaction. Where formalities, contractual procedures or sector-specific requirements matter, the chat must be considered alongside them. Evidence recognition does not eliminate the rest of the legal analysis.

The forum matters when preparing electronic evidence

A chat may be used in a civil suit, a cybercrime matter, an employment process, arbitration or another proceeding. The applicable rules and purpose of the exercise can differ. An internal manager deciding whether more investigation is needed is not making the same decision as a court determining liability. A file prepared for one setting may need additional work before it is suitable for another.

Punjab defamation proceedings provide a specific caution. Section 23 of the Punjab Defamation Act 2024 excludes the Qanun-e-Shahadat Order for proceedings under that Act. Current court orders and operational arrangements also require checking. It would be inaccurate to say that Article 164 automatically controls every Punjab defamation tribunal matter. See the archived official statutory text.

The practical implication is to preserve a reliable source before tailoring presentation to a forum. A complete record, a clear collection history and identified witnesses can assist counsel even when the formal rules differ. Ask which documents must be filed, whether originals or devices may be required, how translations should be presented and what confidentiality protections can be sought. Do not assume that a file format accepted at an initial desk is sufficient proof at a later hearing.

What to do when a significant chat first comes to attention

First identify whether there is an immediate safety or financial risk. A threat, ongoing account compromise or fraudulent payment instruction may require urgent protective action alongside preservation. Do not postpone necessary containment merely to produce a perfect screenshot. Record the steps taken and seek appropriate legal and technical support. If there is an imminent danger to a person, use suitable emergency assistance.

For the evidence itself, record where the conversation is currently available and who has lawful access. Note the device, account, relevant participants and approximate period. Preserve the visible exchange with enough context to understand it, and retain associated documents or media where lawful. Do not edit the source messages, rename contacts to make a point, or send test messages that could alter the conversation.

Avoid impulsive technical changes. Uninstalling the app, resetting the phone, restoring a backup or installing a recovery utility can affect the record. If a device may contain important evidence, obtain advice before changing its state. There is no universal instruction to switch every phone off or disconnect every service: the appropriate step depends on the risk, device condition and technical assessment.

Create a brief collection note while the facts are fresh. Explain what you saw, what you saved and what you could not access. If the chat was forwarded to you, record who provided it and ask about the original source through an appropriate channel. Early honesty about limitations is valuable. It prevents later reviewers from mistaking a second-hand copy for a direct capture from the conversation.

Lawful access and proportionate scope come before convenience

Possessing a phone, knowing a passcode or managing a company network does not answer every legal question about access to messages. A device may contain personal communications, confidential third-party information and material unrelated to the dispute. The organisation should establish the legal and contractual basis for collection, the scope of the request and who is authorised to carry it out.

A company-owned device and an employee-owned device raise different practical issues, but ownership alone should not be treated as a licence for unrestricted review. Existing employment terms, acceptable-use policies, consent, relevant legal duties and the particular circumstances may matter. Counsel should advise on an appropriate process. Staff should not be instructed to bypass account protections or secretly copy private material to strengthen a case.

Where an employee voluntarily supplies a relevant conversation, record what they provided and how it was obtained. Voluntary production does not necessarily resolve every issue involving other participants or unrelated data. Limit onward access and avoid putting entire personal histories into general project folders. A targeted collection may be sufficient, while the source can be preserved under a more controlled arrangement if needed.

Unlawful collection can create legal exposure and complicate evidential use. Do not install spyware, impersonate another account holder, request someone’s one-time passcode or access a former employee’s private account without authority. PECA contains provisions concerning unauthorised access and related conduct, each with its own elements. The purpose of obtaining evidence does not provide a general exemption from those rules.

How to make screenshots more useful without overstating them

A useful screenshot shows the relevant message and enough surrounding conversation to make sense of it. Include available participant information and date context. If a long exchange requires several captures, keep them in order and avoid unexplained gaps. Preserve original image files separately from any versions prepared for annotation. The collection note should identify who captured them, when and from which lawful source.

Contact names deserve particular care. A phone may display “Finance Director” because its owner saved that label. The label is not independent proof of the sender’s position or identity. Preserve the available account or number information through a lawful method and link it to other records where possible. Do not change the contact name before capturing the material merely to make the image appear clearer or more persuasive.

Highlighting can help a lawyer read a long exchange, but it belongs on a copy. Cropping can be useful for a presentation only if the complete version remains available and the crop is not misleading. A screenshot of one message should not be represented as the entire conversation. If part of the screen is obscured or a message is cut off, note the limitation rather than assuming the missing text is unimportant.

A screen recording may help show navigation and sequence, but it also has limits. It can omit earlier content, capture changing material or expose unrelated information. It is not automatically a forensic examination. The appropriate collection method depends on the issue and available access. In a high-stakes dispute, counsel and a qualified specialist can determine whether ordinary captures should be supported by a more structured examination.

Chat exports are useful working material, with important limits

WhatsApp’s official export guidance describes exporting a conversation as a text file, with an option concerning media. It also states that the exported history is not a backup that can be re-imported, and that the media option adds recent media attachments. Treat the result as an export to inspect, not as an automatic complete forensic image of the account. Use the current official export instructions for the relevant device.

Record the export date, source device, chat selected, options used and resulting filenames. Check the beginning and end of the text against the relevant period. Confirm whether important attachments are present and whether the conversation contains indications of omitted media. If the export does not contain the whole period needed, preserve that limitation in the collection note and seek advice on another lawful source.

A text file is easy to search and organise, but it can also be edited. Keep the received export unchanged and create separate copies for analysis. Do not open the only retained file, remove irrelevant-looking lines and then describe the result as the original export. A clean reading copy is acceptable when its relationship to the untouched source is transparent.

Compare key passages with the conversation on the source device where available and appropriate. Note differences in formatting, display names or representation of attachments. The comparison is a quality check, not a guarantee of authenticity. If a case turns on an apparent discrepancy, preserve both versions and ask a specialist to assess it rather than forcing them to match through manual editing.

Choose the export destination carefully. Sending a sensitive history to a personal email address, an unapproved cloud account or a public conversion service may create unnecessary disclosure. Use a controlled location agreed with counsel and the organisation’s responsible team. The app’s share menu offers technical options; it does not decide which destination the user or company is authorised to use.

The source phone and linked devices may hold different material

A conversation visible on a laptop is not necessarily identical in extent to the history available on the primary phone. WhatsApp’s official guidance explains that a newly linked device receives a copy of recent message history and that some deletions sync across logged-in devices. This is a reason to document the source being used rather than assume every screen provides the same complete record. See WhatsApp’s linked-device history guidance.

List the devices that may contain relevant material, without accessing them beyond the authorised scope. Identify whether a source was a primary phone, linked browser session, desktop application or an export received from someone else. Record significant changes such as a phone replacement, account migration or loss of access. These events can help explain differences between copies.

If an employee is leaving the organisation, coordinate preservation before routine device reset or reassignment where relevant and lawful. If a phone is damaged, avoid repeated repair attempts that could affect the record without discussing the evidence need. Technical specialists should be told that the purpose includes preservation, not merely restoring ordinary usability. The appropriate method depends on the device and available information.

Keep the collection process distinct from business continuity. A company may need to maintain customer communications while preserving a particular device or account. Counsel and IT can plan how to do both without casually wiping the source. A documented, proportionate process is preferable to either shutting down operations unnecessarily or treating all device changes as routine when evidence is at stake.

Attachments must be connected to the messages that explain them

An image, PDF or spreadsheet sent through WhatsApp may matter as much as the message around it. Preserve the file where lawful, its displayed name, the surrounding exchange and the available link between the attachment and the conversation. A folder containing a document called “invoice.pdf” does not by itself establish who sent it, which version was discussed or whether it was approved.

For an invoice dispute, distinguish the file supplied in the chat from later accounting records. The supplier may have replaced an invoice, corrected bank details or issued a credit note. Preserve those versions with their dates and context. Do not rename several different files identically or overwrite the earlier version when a revised one arrives. A version history can explain a dispute that otherwise appears to involve contradictory instructions.

Images can also be misleading without their source context. A photograph of goods may show a shipment, but the image alone may not identify the customer, location or time. A photograph of a signed page may be relevant, while the complete agreement and the circumstances of signature still need assessment. Record what is known from the file and what is supplied by a witness or other record.

Do not assume that a thumbnail, preview or compressed copy has all the qualities of an original attachment. Preserve the best lawfully available version and describe its source. If technical properties matter, have an appropriately qualified person examine them. Ordinary users should not alter file properties to make a document fit the chronology. Uncertainty about a file’s origin should remain visible until evidence resolves it.

Voice notes need faithful transcription and careful speaker attribution

A voice note can convey tone, qualifications and timing that disappear in a short written summary. Retain the audio file where lawful and preserve the messages surrounding it. If a transcript is prepared, identify the recording it corresponds to and retain an unchanged copy of that recording. The transcript is an aid to understanding the evidence, not a replacement for the source.

Use timestamps within longer recordings to help a reviewer locate important passages. Mark words that are unclear rather than guessing. Separate speakers where that distinction can be made reliably. If background noise or overlapping speech affects interpretation, say so. A statement that sounds decisive in one isolated phrase may be qualified a few seconds later, so the relevant recording should be reviewed in full.

Speaker identity is a separate question from possession of the file. A recipient may recognise a familiar voice, but the basis of that recognition should be recorded. An expert may be needed where authenticity or manipulation is genuinely disputed. Do not claim that an ordinary listener can rule out all editing or synthetic audio simply because the voice sounds familiar.

Translation requires similar care. Preserve the original language and distinguish literal wording from interpretation of idiom. Where the recording contains several languages, technical terms or names, use a translator able to handle that material. Automated transcription can provide a working draft if used through an authorised process, but it should be checked against the recording. Do not send confidential audio to an outside service without considering the resulting disclosure.

Build a chronology that respects time zones and uncertainty

Messages are often compared with emails, banking records, travel and system logs. These sources may display time differently. Before placing them in one timeline, record the time shown by each source and any known time-zone setting. A Pakistan-based sender, an overseas recipient and a server log can produce different displays of the same event. Do not silently force them into one sequence.

Use a separate column or note for any converted time and explain the conversion basis. Keep the original displayed time available. If a device clock was wrong or its setting is unknown, identify that limitation. A date written in an export may also need interpretation if the format is ambiguous. Confusing day and month can produce a misleading chronology even when every message is genuine.

A practical timeline should distinguish the event described from the time of the message. “We paid yesterday” is a statement sent today about an earlier event. The payment date should be verified from the appropriate record. Similarly, a forwarded photograph may have been created long before it was sent. The act of transmission and the underlying event should not be collapsed into one date.

When precise timing matters, ask the technical expert what can be established from the available sources. Avoid a false level of accuracy. An approximate sequence with clearly stated limits may be more reliable than a timeline displaying seconds unsupported by the evidence. Counsel can then assess whether the remaining uncertainty is important to the legal issue.

Read indicators and silence need careful interpretation

A dispute may turn on whether a recipient received an instruction before a deadline. WhatsApp’s message-information guidance describes information about delivery, reading or playback. Preserve the actual information available for the relevant message rather than relying on somebody’s recollection of an icon. Product settings and circumstances can affect what is shown, so consult the current official read-receipt guidance when interpreting it.

An app indicator and a legal conclusion should remain separate. Even where the record supports delivery or reading, further questions may concern who accessed the device, whether an attachment was considered and whether the recipient had authority to act. An instruction about a payment, a contract notice and a casual reminder do not necessarily have the same legal effect merely because their delivery indicators look similar.

Silence can also be ambiguous. A sender may believe that no objection means approval, while the recipient may regard the message as information only or expect a separate formal process. Preserve the contract, established workflow and surrounding conduct that could explain the exchange. Counsel should assess the significance of silence in the actual circumstances rather than treating it as automatic acceptance or automatic refusal.

Similarly, a brief reaction or acknowledgment may confirm receipt without answering every substantive point. If the dispute concerns its meaning, retain the message being acknowledged and the subsequent exchange. Avoid rewriting an emoji or short reply as a detailed statement the person never made. Ask what the participants understood at the time and what independent records support that account.

For future business communications, an organisation can reduce uncertainty by asking for an explicit response identifying the decision, document version and authorised person. That process should be proportionate to the transaction. It improves clarity going forward; it cannot retrospectively establish what an earlier ambiguous exchange meant. The evidence file must continue to show the earlier record as it actually existed.

Group chats require participant and audience context

A group conversation raises questions that a one-to-one exchange may not. Who was a member at the relevant time? Who could see the message? Was the sender replying to a particular person or speaking generally? Did a quoted message refer to an earlier discussion? Preserve relevant group information and system messages where available through lawful access, while avoiding unnecessary disclosure of unrelated participants’ details.

The current membership list does not necessarily establish membership at an earlier date. People may join, leave, change numbers or be removed. If a person says they never saw a message, the available record of group membership and delivery may be relevant, but each indicator must be interpreted carefully. Being a member of a group does not automatically establish personal knowledge of every message posted there.

Group names are also editable labels. A title such as “Board Approval” does not prove that the group was an authorised decision-making forum or that everyone present held a particular office. Examine the organisation’s actual authority structure and how the group was used. A casual discussion among senior employees may have a different legal significance from a formally authorised communication channel.

For internal review, identify only the participants whose roles matter and preserve the full authorised source in a controlled location. If a chat includes clients or external advisers, consider confidentiality and consent issues before circulating it. A group export can expose far more information than the disputed message itself. Counsel should decide what needs to be produced and how irrelevant personal information should be handled.

Edited messages should be recorded as edited

WhatsApp permits editing within the period described by its current product guidance and displays an edited indicator. Meta’s explanation states that the visible conversation does not show an edit history. The existence of an edited label therefore deserves attention when exact wording matters, but it does not by itself establish deception. See the current editing guidance and Meta’s explanation of the feature.

Preserve the version you actually received or captured and the time of capture. If another participant has an earlier screenshot, record its separate source rather than merging the versions into a single reconstructed image. A witness may remember an earlier wording, but that recollection should be described as a recollection unless supported by a retained record.

Ask what difference the edit makes to the issue. Correcting a spelling error is different from changing an amount, recipient or approval instruction. The legal assessment should focus on the supported history and its significance. Do not assume that an expert can recover every earlier version. Technical conclusions depend on the actual data and method available.

Disappearing messages create a preservation risk, not a shortcut to proof

WhatsApp’s official guidance says that disappearing-message settings apply to new messages and describes limits involving quoted messages, forwarded copies and backup restoration. A backup should not be treated as a guaranteed permanent archive of material that disappears. Review the current disappearing-message guidance rather than relying on memory of an older app version.

When a relevant conversation uses this feature, record the setting you can lawfully observe and seek timely advice on preservation. Do not wait for routine office administration if an important record may become unavailable. At the same time, avoid changing settings or using another participant’s account without authority. Record any authorised change and its purpose.

If messages have already disappeared, document what remains and the basis of any recollection. Other lawful sources may include related email, documents, transaction records or a participant’s separately preserved copy. Missing content should not be reconstructed as if it were recovered. An allegation that someone deliberately destroyed evidence requires a factual and legal assessment; the mere existence of a privacy setting does not establish that conclusion.

View-once content presents additional restrictions. Do not attempt to bypass security features or redistribute intimate or unlawful material to create a case file. If the material involves threats, exploitation or other serious harm, obtain specialist advice on safe reporting and available lawful evidence. Preservation must remain compatible with the safety and rights of the people involved.

A forwarded message needs a source explanation

A forward shows that material was passed along in a particular conversation. It does not necessarily establish the identity of the original creator or preserve the complete context of the first exchange. WhatsApp’s official help explains its forwarding labels, but those labels are not a complete legal provenance record. See the official forwarding guidance.

Record who supplied the forward and what they know about its source. Did they participate in the original exchange, receive it from somebody else or find it in a large group? Can the original conversation be preserved through a lawful route? If not, the limitation should be clear in the file. Do not convert a chain of hearsay about a message into a confident statement that a named person authored it.

Forwarded attachments need the same care. A genuine document may have been sent with a misleading caption. A voice note may have been detached from the exchange that explained it. A photograph may have been reused for a different event. Compare the file with other available records, and preserve the forwarding message because it may show what the recipient was told at that stage.

In a corporate setting, staff should send potentially relevant forwards to the designated reviewer without broadcasting them more widely. The reviewer can decide what further source enquiry is appropriate. Each unnecessary forward increases distribution and can complicate the record, particularly where it contains personal information or a serious accusation. Evidence collection should clarify provenance, not create another round of unsupported publication.

Business accounts and shared access need an authority analysis

A business account may be operated by an owner, staff member, customer-service team or service provider. Identify the account arrangement and the relevant period. A company logo or business description can help explain how the account presented itself, but it does not conclusively establish which person sent a particular message or what authority they had to commit the company.

Preserve relevant staff assignments, access permissions, agency instructions and approval records. If customer-service replies are generated through a separate business system, identify that system and its record sources. Do not assume that a screenshot from one employee’s phone contains every business interaction. The organisation’s technical team should explain how the account was actually used, without speculating beyond the records.

Authority and authorship should remain separate. A staff member may have written the message but lacked authority to change bank details or accept contract terms. Another person may have approved the instruction without sending it personally. The surrounding documents, policy and conduct can matter. A legal assessment should avoid treating the account’s business label as a complete answer to those questions.

If compromise is alleged, preserve the basis for that concern: unusual access, unexpected instructions, relevant security notifications or contemporaneous reports. A later assertion that “the account was hacked” is not self-proving. Equally, an authentic-looking message should not be accepted uncritically where reliable records indicate unauthorised use. The objective is a supported attribution account, including unresolved possibilities.

Encryption does not replace preservation on the available lawful sources

WhatsApp states that personal conversations are protected by end-to-end encryption and explains that business messaging and interactions with other features can involve different arrangements. That privacy design should not be confused with a promise that a service provider can supply a complete readable history for litigation. Consult WhatsApp’s current privacy explanation for the relevant type of communication.

For evidence planning, identify what the participants, devices and authorised business systems actually retain. A user’s export, a phone examination and a lawful provider request are different sources with different potential limits. Do not delay preserving accessible material because somebody assumes that “the company will have everything on its servers.” Availability and legal access need verification.

Encryption also does not prove the truth of a statement after it reaches a participant. A person can send an inaccurate claim through a secure channel. A recipient can later produce a misleading excerpt or an edited text file. The legal review still needs source information, context, attribution and corroboration. Technical security and evidential reliability are related questions, but neither automatically answers the other.

Design a preservation instruction around the actual dispute

For a substantial corporate matter, counsel may recommend a focused preservation instruction. It should identify the relevant people, conversations, account types, devices and associated records. It should explain that responsive material must not be deleted or overwritten while the issue is assessed. The scope should be understandable to the custodians and reviewed when the facts change.

Include records outside WhatsApp that explain the communication. A disputed price approval may require quotation versions, purchase orders and the delegation-of-authority policy. A threatening exchange may require earlier contact and incident reports. A payment-diversion case may require bank confirmations and supplier verification records. Preserving only the app conversation can leave the most important questions unanswered.

Coordinate with ordinary operations. Device refreshes, employee departures, account changes and retention settings may affect relevant sources. Ask responsible teams what is scheduled and what can lawfully be preserved without unnecessary disruption. Record any limitation, such as a device already reset before the dispute was known. The instruction should not imply that material was saved when it was not.

Keep collection and access proportionate. A hold can require preservation without granting everyone access to everything preserved. Personal or sensitive material may need restricted review by an appropriate person. Set a process for questions so employees are not left to make risky technical decisions. At the end of the matter, retention and disposal should follow legal advice and applicable obligations rather than an automatic purge or indefinite accumulation.

Maintain a custody record that a new reviewer can understand

A custody record explains how an item moved from its source into the evidence file. It should identify the collector, source, date, method, files received, storage location and subsequent transfers. For an ordinary matter this can be a straightforward log. For a forensic examination or formal seizure, more specific procedural requirements may apply. The terminology should not imply a forensic process where only a routine export occurred.

Give each item a stable identifier. For example, one entry can identify an untouched chat export, another its attachment folder and another a set of screenshots captured from the phone. Record their relationship without changing the underlying files. If a witness supplies a corrected export or an additional device copy, add it as a separate item rather than replacing the earlier entry silently.

Record material handling events, such as copying a file for counsel, providing a device to an expert or receiving a return package. Note the reason for the transfer and the recipient. Access controls and secure storage help, but a clear human-readable explanation remains useful. A judge, investigator or new lawyer should be able to follow the record without knowing the organisation’s internal folder conventions.

A custody log cannot cure an unknown or unreliable origin. If a screenshot arrived anonymously, logging its receipt does not establish how it was made. The log should preserve that uncertainty. It is a record of handling, not a certificate that all prior events were authentic. This distinction makes the file more credible because it shows exactly which parts of the history are supported.

What hash values can show, and what they cannot

A cryptographic hash is a value calculated from a file using a particular method. In evidence handling, it can help compare a later copy with a recorded reference file. If the method is appropriate and the values match, that supports the conclusion that the compared byte content is unchanged. The person performing the process should record the method, the files and the point at which the reference was created.

A hash does not establish that the reference file was genuine when collected. It cannot independently show who typed a message, whether an export was complete or whether a statement in the conversation was true. A fabricated screenshot can also be hashed. The value helps with a defined integrity question after a reference point; it is not a universal authenticity seal.

Different representations of the same conversation can have different hashes. A text export, a PDF made from it and a screenshot are different files. Even harmless changes to a working document can change its value. That does not necessarily establish wrongdoing, but it does mean the files should not be described as identical. Preserve the original and explain how each derivative was produced.

For a routine review, management may not need to calculate hashes personally. A qualified custodian or expert can decide whether they are appropriate and explain the result. Ask for a clear statement of what was compared and what the conclusion supports. Avoid technical language that sounds impressive but leaves the actual evidential question unanswered.

A magnifier over layered message cards symbolizes checking authenticity and context. — A reliable chronology links messages to their source files, participants and supporting records.

Give a forensic specialist a question they can actually answer

A useful instruction to an expert identifies the disputed issue. Examples include whether two files match, whether a supplied export is consistent with data found on an authorised source device, or whether available records support a particular sequence. “Prove that the other side is lying” is not an appropriate technical instruction. It prejudges the conclusion and fails to define a reproducible examination.

Provide the expert with the source history, relevant devices or copies, collection notes and known limitations. Explain the authority for access and any privacy restrictions. Ask them to preserve the record of their method and distinguish observations from interpretation. The report should describe what was examined, which tools or procedures were used where relevant, and what could not be determined.

Expert opinion should remain within the expert’s competence. A technical specialist may explain data consistency or signs of manipulation without deciding whether a contract was legally formed or a statutory offence is proved. Counsel should connect technical findings to the legal issues. Where the report uses uncertain language, management should not convert it into a stronger claim in a public statement.

Not every case requires a full device examination. The appropriate level of work depends on the dispute, available corroboration, challenge to authenticity and proportionality. Conversely, a high-value case resting on a contested screenshot may justify deeper review. Discuss costs and scope before commissioning broad extraction. Any expectation of recovering deleted material or earlier message versions should be assessed from the actual device, not promised in advance.

Create readable working copies without changing the source

A working copy can make a long exchange easier to analyse. It may group relevant passages, add page numbers or place a message beside the related invoice. The reader should be able to trace every extract back to an identified source. Keep a clear distinction between the untouched export, the presentation copy and the reviewer’s notes.

Do not silently correct spelling, punctuation or amounts in quoted messages. A typo may be irrelevant, or it may matter to the disputed meaning. If clarification is needed, put it in a separate note. Similarly, do not remove an awkward message because it interrupts the preferred narrative. If an extract omits material, make the omission apparent and retain enough context for fair interpretation.

When converting to PDF, check that long messages, dates and attachments are represented accurately. Searchability and page numbering help a lawyer, but conversion can introduce formatting problems. Review the output against the source, particularly around page breaks, multilingual text and quoted replies. A neatly formatted bundle is useful only if it remains faithful to the material from which it was made.

Keep analysis separate from evidence. A note saying “This proves approval” is an interpretation, while the underlying message is the evidence being considered. Label the note as such. This distinction allows another reviewer to disagree without losing the original record and prevents internal commentary from being mistaken for part of the conversation.

Redact disclosure copies carefully and keep an authorised original

A chat can contain phone numbers, bank details, family matters and unrelated client information. Those details should not be circulated simply because some messages are relevant. Counsel should determine what needs to be disclosed to each recipient and whether a redacted copy is appropriate. A management briefing, an expert instruction and a court filing may require different material.

Redact a separate copy and retain the unaltered source under appropriate controls. Record what category of information was removed and why. Do not redact a qualification or competing explanation merely because it weakens the case. The purpose is to protect irrelevant or sensitive information while preserving a fair account of the relevant exchange.

Use a method that actually removes the protected content from the disclosure copy rather than placing a cosmetic shape over recoverable text. Have a competent person check the result before sharing. This is particularly important for searchable PDFs and documents that may contain hidden text or comments. Do not test the method by uploading private material to an unapproved online service.

If the other side reasonably needs unredacted context, counsel can assess the appropriate process and any confidentiality measures available. Avoid promising absolute secrecy. A legal dispute may require disclosure under applicable rules or orders. The organisation should understand that possibility before sensitive conversations are used as a central part of its case.

Translate the conversation without improving its meaning

Business chats in Pakistan frequently mix English, Urdu and Roman Urdu, with abbreviations, voice notes and regional expressions. Translation should preserve meaning without turning informal language into a more definite commitment. A phrase expressing willingness to discuss terms should not become a firm acceptance merely because the English version sounds more polished.

Retain the original text alongside the translation and identify the translator’s role. Where a word has more than one plausible meaning, explain the uncertainty. Technical terms, trade names and abbreviations should be checked against the transaction. If the translation relies on a participant’s explanation, record that source rather than presenting it as an independent linguistic conclusion.

Numbers and dates require special attention. A misplaced decimal, misunderstood abbreviation or reversed date format can change the entire dispute. Check amounts against invoices and payment records where available. Do not alter the original message to make it consistent with those records. A discrepancy may itself be relevant and should remain visible.

For formal proceedings, ask counsel about the required presentation and verification of translations. An informal staff translation may help the initial review but may not be the appropriate final evidence. Automated tools can assist only within an authorised, secure workflow and require human checking. The result should be faithful, traceable and candid about what cannot be translated confidently.

Witnesses should explain their own knowledge

A participant can explain the circumstances of a conversation: how the parties knew each other, what project they were discussing and which records were exchanged. That account may be important where the text is brief or ambiguous. The witness should distinguish direct knowledge from assumptions about what another person intended or did after receiving a message.

Ask open questions about the source and sequence. Which phone did the witness use? Did they send the message personally? Were they shown it later? Did someone else have access to the account? What happened next? Record answers accurately, including uncertainty. A confident but unsupported answer is not improved by being repeated in a formal-looking statement.

Where several employees are involved, obtain their accounts without requiring them to adopt one standard narrative. Differences may reflect different roles or memories and can help identify records worth checking. If a witness corrects an earlier recollection after reviewing the source, preserve the correction. The objective is an accurate record, not cosmetic uniformity.

Prepare witnesses for the process by explaining the documents and the need for truthful answers. Do not coach them to conceal gaps or to describe a forwarded copy as an original exchange. If a witness cannot authenticate a file, another source or expert assessment may be needed. Their genuine knowledge is valuable precisely because its boundaries are clear.

Use independent records to test the conversation

A chat is often most useful when it connects to records created for another purpose. A bank statement can help test whether payment occurred. A dispatch record can help test delivery. An access log can help identify who used a business system. An email can show which version of a proposal was being discussed. These records may support the chat, qualify it or reveal an alternative explanation.

Check that the records concern the same transaction. Similar customer names, repeated invoice numbers or multiple project phases can lead to accidental mismatches. Record the identifiers linking the sources. If the message says “the second order,” explain which order that refers to and how the connection is established. Do not rely on a reviewer’s memory when the file can make the relationship clear.

Consider contradictory evidence with equal care. A message may say that approval was obtained while the approval system shows a pending request. That discrepancy might reflect an informal approval, a mistaken statement or a different item. Investigate before choosing the explanation that best suits the case. A defensible conclusion considers the relevant evidence rather than treating every inconsistency as proof of bad faith.

Independent corroboration also helps allocate responsibility. A person who forwarded an instruction may not have originated it; a person who approved a contract may not have authorised a later payment change. The surrounding records can distinguish those roles. That distinction matters for fair internal decisions as well as for any external legal allegation.

Responding to a challenge that the chat is incomplete or fabricated

First identify the exact challenge. The other side may dispute authorship, completeness, an amount, a date, an attachment or the source device. A general accusation of fabrication should be clarified where possible. Different objections call for different evidence. A full device examination may not answer a question about contractual authority, while a signed contract may not resolve whether a screenshot was altered.

Review the collection history before responding. Can the source device still be accessed lawfully? Is the untouched export available? Are the original captures retained? Who can explain the process? Acknowledge genuine limitations. An honest statement that one attachment is unavailable is more reliable than a categorical claim of completeness that later proves wrong.

Then identify proportionate checks. Comparison with another participant’s authorised source, expert examination or independent transaction records may help. Any exchange of devices or records should be arranged through an appropriate legal process with privacy safeguards. Do not demand private passwords as a condition of believing the other side, and do not attempt to access their account independently.

A technical discrepancy does not always show deliberate fabrication. Different exports, formatting or device histories can produce differences that need explanation. Conversely, a plausible technical explanation should not be accepted without support where the discrepancy is material. Counsel and the expert should state which conclusions the evidence supports and which questions remain unresolved.

Using WhatsApp material in a cybercrime complaint

If the conversation concerns potentially criminal conduct, the complaint should explain the acts and relevant evidence rather than rely on a bundle of screenshots alone. Identify the complainant, the affected person or entity, the participants as far as known, the chronology and the specific disputed conduct. Separate what happened through the app from associated payments, account access or offline events.

NCCIA is the current PECA agency, and its official guidance identifies complaint channels and verification requirements. Check the NCCIA FAQs and the official complaint portal before relying on an older filing guide. Submission does not automatically establish an offence, identify the account operator or result in an FIR.

Provide an evidence index explaining each item and retain the source material. If data may be lost, tell counsel which records are at risk so the appropriate preservation issue can be raised. PECA contains powers and safeguards for authorised officers and court processes; those provisions do not give a private complainant unrestricted access to another person’s data. See PECA sections 31–36.

If an authority requests a device or additional material, obtain advice on the lawful process, documentation and practical arrangements. Do not promise that counsel can replace every personal attendance or that every device will be returned immediately. Keep records of submissions and respond consistently if more information is requested.

Preparing the file for litigation or a formal hearing

A hearing bundle should allow the decision-maker to find the relevant message and understand its source. Use stable page or item references, identify the parties and dates, and link important attachments to their messages. Avoid flooding the file with unrelated conversation merely to create volume. Counsel should decide what needs to be filed and what should remain available as supporting source material.

Explain the method of preparation. If a PDF was created from an export, say so. If a translation accompanies a voice note, identify the recording and translator. If a witness captured screenshots, preserve the account of collection. The file should not suggest that a lawyer personally witnessed a conversation they only received later.

Anticipate reasonable questions about gaps, device access, shared accounts and context. An answer may be an additional record, a witness explanation or a candid limitation. Do not add unsupported technical statements to make the bundle appear stronger. A specialist report should be used for the questions it actually examined.

Finally, follow applicable orders and procedure for disclosure, confidentiality and production. A general article cannot determine the requirements of an unseen case. Evidence that was sufficient to justify an initial inquiry may need further proof at trial. The preparation process should therefore be guided by the actual issues and forum, not by a universal claim that screenshots are always enough.

Hypothetical example: a disputed purchase approval

A supplier claims that a company approved an increased order price in a WhatsApp exchange. The supplier produces a screenshot showing the procurement manager replying, “Approved, please arrange.” The company says the manager approved only the revised delivery schedule. The screenshot does not show the preceding attachment or a later message. The disagreement turns on context and authority as well as the authenticity of the image.

The first task is to preserve the complete relevant conversation from lawful sources. Identify the quotation or schedule attached immediately before the reply, any quoted-message link, and subsequent clarification. Preserve the purchase order versions, contract terms and internal approval rules. The organisation should establish which decisions the manager was authorised to make and whether the supplier knew of any relevant limitation.

A chronology may show that two changes were under discussion on the same day. One message may refer to transport timing while an email concerns price. The reviewer should link each communication to the correct document rather than treat every use of “approved” as the same decision. If the manager says there was a clarifying telephone call, record that account and seek available supporting information without presenting an unrecorded call as a transcript.

The supplier’s screenshot may be entirely genuine and still incomplete for the issue. The company’s preferred interpretation may also be wrong once the attachment is reviewed. Both possibilities should remain open during assessment. If exports from the two participants differ, document the sources and ask what explains the difference before making an allegation of fabrication.

The resulting legal advice should address the actual contract, authority and evidential position. A message through WhatsApp is not automatically ineffective, and it is not automatically a binding variation merely because it uses a decisive word. The case illustrates why preserving the attachment and the complete sequence can be more important than enlarging the one sentence that initially attracted attention.

For future operations, the company may choose a clearer approval workflow that records the document version, amount and authorised decision-maker. That is a process improvement, not a retrospective rewrite of the evidence. Any new policy should be dated and should not be represented as a rule that was already in place when the disputed exchange occurred.

Hypothetical example: an impersonated payment instruction

A finance employee receives a message from an account displaying a familiar supplier name. It requests urgent payment to a changed bank account and includes an invoice image. The employee processes the transfer, and the genuine supplier later says it never changed its details. The company needs to contain the incident and investigate how the instruction reached the employee.

Urgent contact with the bank through a verified channel and appropriate internal escalation should not wait for a perfect evidence bundle. At the same time, preserve the conversation, the account information, the invoice file, the payment record and any verification attempt. Record what the employee actually saw and did. Do not rename the contact to “fraudster” before preserving the original display and relevant source information.

Compare the instruction with the established supplier records. Was it sent from a different number, a compromised known account or an authorised business channel used by someone else? Was the invoice altered, or was a genuine invoice paired with a false payment request? Did an email or telephone call accompany it? These questions help distinguish the apparent account identity from the evidence of who controlled the communication.

The employee’s account should be obtained fairly. A failure to follow a verification process may be relevant to internal controls, but it does not establish that the employee participated in fraud. Equally, a claim that the number looked familiar should be checked against the available records. Keep the incident investigation focused on evidence and avoid premature accusations in staff groups.

If a cybercrime complaint is appropriate, the chat should be connected to the transaction and the alleged deceptive conduct. The legal team can assess the relevant provisions and reporting route. No screenshot, complaint reference or tracing request guarantees that funds will be recovered. The company should distinguish recovery efforts from evidence preservation and from improvements to its payment controls.

After containment, document the verified sequence and the remaining gaps. A management report should explain which controls were used, which were bypassed and what corrective action is proposed. It should not present the messaging app itself as the sole cause when authority, verification or access weaknesses also contributed.

Hypothetical example: a workplace complaint based on chat excerpts

An employee submits screenshots of messages they consider threatening from a supervisor. The supervisor says the screenshots omit an earlier disagreement and that another person sometimes used the work phone. HR needs to assess the complaint while supporting the people involved and preserving potentially relevant evidence. Neither immediate dismissal of the complaint nor a finding of guilt from two images is an adequate starting point.

Record the employee’s account and the source of the captures. Preserve the relevant exchange, including available dates, participants and surrounding context, through a lawful and proportionate process. Ask about any immediate safety concern and respond through suitable organisational and emergency channels where needed. Evidence work should not prevent practical protection against a credible risk.

The supervisor should have an appropriate opportunity to explain the messages and the shared-access claim under the applicable process. Identify records that may help: device assignment, relevant work schedules, prior communications and any contemporaneous report of unauthorised use. A theoretical possibility of shared access is different from evidence that somebody else sent the messages.

The earlier disagreement may help explain context without justifying threatening conduct. Conversely, a cropped phrase may have a different meaning in the complete exchange. The reviewer should examine the actual wording and circumstances rather than allow either side to define the conclusion through labels. If the source device contains unrelated personal material, collection should remain limited and appropriately controlled.

HR findings, disciplinary decisions and potential criminal allegations involve distinct questions. Counsel should advise on the relevant employment and legal framework. Do not assume that a company policy violation automatically proves a PECA offence or that absence of a criminal complaint prevents an internal response. The evidence should be used for the decision it can legitimately support.

The file should also record who received the evidence and how confidentiality was managed. Circulating screenshots broadly can harm both the complainant and the subject of the allegation. A controlled review protects the quality of the process and reduces the risk that workplace discussion becomes another source of misleading or retaliatory publication.

A practical review checklist for in-house counsel and management

Before relying on WhatsApp material for an important decision, confirm the issue it is intended to establish. The file should identify the transaction or conduct, the relevant participants and the disputed proposition. If the team cannot explain why a particular message matters, it may be collecting volume rather than evidence. Refine the question before commissioning further work.

Review the source and collection record. Is the material a direct capture, an export, a forward or a derivative document? Who obtained it, from which lawful source and when? Are the originals retained? Does the file explain gaps and technical changes? These questions should produce a clear account rather than a list of software names with no explanation of their use.

Test attribution and authority separately. Identify the basis for linking the account to a person and the basis for saying that person could make the disputed decision. Consider supported alternative explanations, including shared access, impersonation and misunderstood context. Do not inflate a remote possibility into a finding, but do not ignore a plausible explanation because it is inconvenient.

Check corroboration, presentation and disclosure. The supporting documents should match the transaction. Translations should be faithful. Redactions should protect sensitive information without removing material context. A working copy should be traceable to its source. The intended recipient should receive only what is necessary through an appropriate channel.

Finally, ask counsel to connect the evidence to the applicable forum and current legal requirements. Record what remains uncertain and which additional step could resolve it. The organisation should authorise any expert work, external complaint or sensitive disclosure with an understanding of its purpose and limits. A well-organised file supports better decisions even when it does not produce the answer management initially expected.

Blank message bubbles along a sequence illustrate building a conversation timeline. — Prepare an indexed file that distinguishes original evidence, working copies and legal questions.

Preparing a WhatsApp evidence consultation

Start with a brief explanation of the dispute and the decision you need help with. Identify the relevant conversation, approximate period, participants and source devices. Tell counsel whether the other side disputes authorship, completeness or meaning, and whether any complaint, notice or proceeding already exists. Include complete official documents where available, not isolated photographs of their headings.

Bring an index of the material you hold and explain how it was collected. List exports, screenshots, attachments, voice notes and related business records separately. Identify missing items and any device changes. A lawyer can then assess whether the existing file is sufficient for an initial opinion or whether further preservation, witness information or expert work is proportionate.

Do not transmit an entire personal or corporate archive through a general enquiry. Ask for an appropriate method to share sensitive material after the scope is understood. Passwords, one-time passcodes and private account recovery information should not be included in ordinary messages. Where evidence involves intimate or unlawful content, describe the issue first and obtain specialist handling advice.

For legal support concerning digital evidence in Pakistan, contact Legal Bridge LLP® or WhatsApp 0321-4277856. The stated office is Office No. UFG-11 & UFG-12, Central Plaza, Barkat Market, Garden Town, Lahore, Pakistan. Confirm appointment arrangements before visiting. An enquiry does not itself create a lawyer-client relationship or guarantee acceptance of a matter.

Frequently asked questions

Are WhatsApp screenshots admissible in every Pakistan court?

There is no universal guarantee. Pakistan’s legal framework recognises electronic material, but the applicable forum, relevance, source, integrity and proof still matter. A screenshot may be useful for one question and insufficient for another. For example, it may show the wording displayed to a recipient without independently identifying the person who typed it.

Preserve the source and full relevant context, and ask counsel how the material should be introduced in the particular proceeding. Do not rely on a foreign certificate rule or an outdated quotation of Article 164 as a complete answer. Special statutory procedures, including the Punjab Defamation Act’s evidence-law provision, require separate consideration.

Does a chat export prove that nothing is missing?

No. An export is a useful representation to inspect, not an automatic assurance that every message, attachment or earlier version is included. The available history, export options and device circumstances can affect what the file contains. Record those circumstances and compare key material with the lawful source where possible.

Keep the untouched export and identify any missing period or attachment. If completeness is disputed, counsel and a specialist can assess what further evidence is available. Do not manually add reconstructed messages to the export. Recollections or additional copies should remain separately identified so a reviewer can see their different origins.

Can I use a conversation supplied by another employee?

Potentially, but establish how the employee obtained it and what they can explain about its source. A participant’s own export is different from a screenshot received through several forwards. Also consider authority, privacy and the scope of the proposed use. The fact that a file has reached the company does not settle every question about lawful collection or disclosure.

Record the employee’s account without coaching and preserve the material as received. Seek advice before accessing their personal device or circulating unrelated messages. The evidence may need corroboration or a more reliable source before it supports an important legal or employment decision.

Should I remove irrelevant messages before giving a chat to my lawyer?

Keep the original unchanged. You can prepare a separate index or reading copy highlighting the passages you consider relevant, provided the extract is clearly identified and enough context remains. Tell the lawyer that other material exists so they can decide what is necessary to understand the issue.

Do not delete a qualification, an unfavourable message or a competing explanation from the only retained record. If privacy concerns make a full transfer inappropriate, discuss a controlled review or redaction process. Evidence preservation and proportionate disclosure can be managed together without silently rewriting the conversation.

Does a forensic report or matching hash guarantee authenticity?

No single technical result answers every authenticity question. A matching hash can support comparison with a recorded reference file. It does not independently establish who created that reference, whether the conversation is complete or whether the statements are true. A forensic report should explain its sources, methods, conclusions and limits.

Ask what disputed question the examination actually answered. A finding that two files match is different from a finding about account use, and neither necessarily resolves contractual authority. Counsel should connect the technical result to the legal issue without overstating it. An expert’s qualified conclusion should remain qualified when presented to management or a court.

What if the original phone is lost, damaged or no longer available?

Document what happened and preserve every lawful remaining source. These may include an earlier export, a participant’s retained copy, attachments, related emails, transaction records and witness knowledge. Identify each source accurately. The absence of the phone does not automatically decide the whole case, but it can limit the checks that are possible.

Do not promise recovery or use an untrusted utility that could compromise accounts or alter data. A qualified specialist can assess the available device or backup situation. Counsel can then evaluate the evidential position and any additional proof needed. Be candid about the gap rather than presenting a derivative file as if the original device had been examined.

Reliable evidence begins with an honest source record

The most persuasive WhatsApp file is one that a new reviewer can follow: where the material came from, how it was preserved, who can explain it and what independent records support it. A polished screenshot or a large export cannot replace those fundamentals.

For companies and professionals, define the issue early, preserve the lawful source, keep working copies separate and test attribution and meaning fairly. Use technical expertise for questions that need it and current legal advice for the applicable procedure. Those steps improve the quality of decisions without pretending that an app record guarantees the outcome of a dispute.

Sources and research note

Sources checked on 8 October 2026. Legal requirements depend on the applicable forum and current law. Product documentation describes technical features and does not determine legal admissibility. Menus and behaviour can change; follow the current official guidance for the relevant device.

Electronic Transactions Ordinance 2002, official Pakistan Code text. Sections 3–9 and 13–15; electronic form, integrity, retention, signatures and attribution require their applicable conditions.
2023 Gazette amendment to Qanun-e-Shahadat Article 164. Section 12 provides the amended text; do not substitute an older online formulation.
Sindh Judicial Academy Qanun-e-Shahadat compilation. Article 59 and related electronic-document provisions. The Gazette above controls the Article 164 amendment discussed here.
Punjab Defamation Act 2024, archived print of official text. Section 23 is a forum-specific evidence-law exclusion; current orders and notifications require case-specific checking.
Prevention of Electronic Crimes Act 2016, official consolidated publication. Unauthorised access provisions and sections 31–36 on preservation, acquisition and safeguards.
NCCIA official FAQs. Current complaint information and verification requirements.
NCCIA official complaint portal. Official reporting destination; no successful submission or guaranteed availability implied.
WhatsApp Help Center: export chat history. Official product guidance; exports are not re-importable backup files and require inspection for scope.
WhatsApp Help Center: linked-device history. Official explanation of recent-history copies and deletion synchronisation.
WhatsApp Help Center: editing messages. Current product instructions and edited-message indicator.
Meta: WhatsApp message editing. Official explanation of the edited indicator without a visible edit history.
WhatsApp Help Center: disappearing messages. Official feature description and retention limitations.
WhatsApp Help Center: view-once media. Feature restrictions support careful, lawful handling rather than circumvention.
WhatsApp Help Center: forwarding messages. Forward labels do not replace evidence of original provenance.
WhatsApp privacy questions. Personal-message encryption and distinctions involving business messaging and other features.
WhatsApp Help Center: read receipts. Product indicators should be distinguished from legal conclusions about knowledge, authority or assent.