How often have I seen it? In Brazilian courts, WhatsApp screenshots land on the judge’s bench nearly every day. It’s become routine—someone brings an image of a conversation, claiming it’s the “smoking gun.” Yet, almost as quickly, those screenshots are questioned. Judges, lawyers, and experts ask: Who captured this? When? How do we know this wasn’t changed? The process behind that screenshot is almost never explained or properly documented, which immediately raises doubts about its value as evidence.
WhatsApp is at the heart of commercial, labor, criminal, and even family disputes in Brazil. Sometimes, a single chat message means the difference between a clean acquittal and a conviction. But there is a wide gap between having a screenshot and having something a court will accept. In my experience, everything depends on how the device and messages are handled in the first 48 hours after trouble appears. This short window determines whether you will have usable evidence or just a blurry picture with no weight at all.
Why WhatsApp screenshots are usually weak
When I’m called into a case, the first thing I want to know is how the messages were collected. And honestly, screenshots often set off alarms. Here’s why:
- Screenshots don’t carry technical metadata like sender IDs or message timestamps outside of what’s visible. There’s no evidence the image came from a specific device.
- Screenshots are easy to forge. Any basic editing tool can insert or delete messages almost perfectly.
- If the opposing side challenges a screenshot, it’s very hard to prove it’s genuine—especially in courts that want clear technical documentation.
The solution many people hear about is the ata notarial. This is where a notary records what they see displayed on a device. While it proves that certain content appeared on a device at a certain time, its reliability is limited. It does not prove whether the WhatsApp database was altered or if the app itself had been tampered with beforehand.
Over the years, I’ve learned that for serious allegations, like labor harassment, fraud, or criminal threats, an ata notarial alone falls short. You need proper forensic work to back up every claim.
The legal frame: Chain of custody and technical standards
Brazil’s Pacote Anticrime (Law 13.964/2019) finally brought chain of custody to the front lines, especially with Articles 158-A to 158-F of the criminal procedure code. These rules explain that evidence must be thoroughly traceable in ten distinct steps: recognition, isolation, fixation, collection, packaging, transport, receipt, processing, storage, disposal.
For a judge or jury, any gap in this chain gives the other side real ammunition. While this is written for criminal law, I’ve seen many civil, corporate, and labor courts borrow these requirements by analogy. A break in the chain leads to reasonable doubt about the evidence, whatever the subject of the dispute.
On the technical side, two standards guide real forensic work in Brazil:
- ABNT NBR ISO/IEC 27037:2013 for identification and collection
- ABNT NBR ISO/IEC 27042:2016 for analysis and interpretation
If you stray from these standards, you need a very strong technical explanation.
How a solid WhatsApp forensic process works
Let’s say the device is available. Here’s what I would do, step by step:
- Identify and isolate the device. I photograph it, record its IMEI and serial numbers, and get it off any networks.
- Document its state. Note battery level, OS and WhatsApp versions, and SIM cards inserted.
- Use forensic software (like Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, or MOBILedit) to get a logical or file-system dump.
- Extract WhatsApp files: on Android, that means the /data/data/com.whatsapp/ folder plus msgstore.db and wa.db files; on iOS, it’s usually ChatStorage.sqlite and media from an iTunes-style backup.
- Hash every file (SHA-256 is standard, sometimes MD5 is also used).
- Log every transfer, every handling, every analysis—always recording time, place, person, and hash values.
- Do all analysis on a working copy, preserving the original sealed and untouched.
- Parse the messages and attachments, verify timestamps, looks for signs of tampering.
- Produce a full forensic report (laudo pericial) with details, methodology, and answers to the technical questions (quesitos) raised by the court or other parties.
A real-world scenario: Atlas Componentes Ltda.
To show how much first steps matter, let me tell you about a typical case (names and places tweaked for privacy). Atlas Componentes Ltda., in Joinville, suspects a purchasing manager is taking kickbacks from a supplier. The legal team finds a string of WhatsApp messages between the manager and a vendor. They need to decide whether they have grounds for dismissal for cause, a damages lawsuit, or even a criminal complaint. The whole outcome depends on the reliability of those messages.
They have two choices:
- Poor handling scenario: An internal IT analyst screenshots the phone and then locks it in a desk for weeks. There’s no record of who did what or when. By the time I’m brought in, the chain of custody is already broken. The evidence cannot be fully trusted in any serious dispute.
- Proper handling scenario: The legal team immediately orders the device sealed on discovery. It is delivered directly to the forensic lab, with a complete chain of documented steps. The device is hashed, all files are collected according to protocol, and a laudo pericial is produced that survives all scrutiny. Now, the evidence is strong enough to support legal actions—from dismissal to lawsuits and even police reports.
Seven critical mistakes to avoid
In the real world, these errors are common and often fatal for a case:
- Letting internal IT staff handle the device before legal or a forensic expert is called. This often breaks the chain of custody.
- Using WhatsApp Web or "Export Chat" .txt files as your main evidence. These can be changed easily and do not include key metadata.
- Relying on cloud-only downloads or backups without documenting device state and collection limits.
- Failing to authenticate audio or video messages, which may be critical to the dispute.
- Over-promising about deleted message recovery. Most deleted chats are gone unless a backup was created before deletion.
- Skipping the essential report step of directly answering the court’s technical questions (quesitos).
- Not logging every transfer or action with time, place, hash, and signatures.
First steps define the entire case. Treat the device as evidence from the start.
Conclusion: Secure the device, log every step, act fast
The single decision that shapes the whole future case is made at the very beginning. As soon as a digital dispute appears, treat the device and its data as formal evidence—seal it, record every step, and call in qualified experts immediately. Once the chain breaks, you can never go back. If you would like to better understand how to prepare your team for this, I recommend checking out my profile and content, where I share practical tips on digital readiness and forensic preparation for businesses and professionals.
If you need more detailed guidance, or want to read more about digital evidence types and pitfalls, visit my collection of posts on these topics. Staying proactive is the best defense.
Frequently asked questions
What is WhatsApp evidence in court?
WhatsApp evidence refers to any messages, voice notes, media, or data from WhatsApp used as proof in legal proceedings. In Brazil, courts often demand that such material be collected with clear documentation and proper chain of custody, especially for serious disputes. For more depth, I have discussed the technicalities in other articles such as the basics of digital evidence.
How to use WhatsApp chats legally?
The best way to use WhatsApp chats as valid evidence is to preserve the device, avoid making changes, and document every action. A proper forensic extraction using approved tools, alongside an ata notarial if possible, will help guarantee the chats’ integrity. Always answer the specific technical questions required by the court in your report.
What are common mistakes with WhatsApp evidence?
Common mistakes include using screenshots with no documentation, failing to log every handling step, relying on easily-changed exports, not authenticating audio or video files, and letting unauthorized staff handle the device. For details, I have covered each of these pitfalls in depth on posts like common mishandling scenarios.
Is WhatsApp evidence accepted in Brazil?
Yes, WhatsApp evidence is accepted in Brazilian courts, but only if collected and preserved properly. Screenshots alone can be challenged and dismissed, while well-backed forensic evidence tends to hold up even in tough disputes. Applying proper chain of custody is essential.
How can I avoid WhatsApp evidence issues?
Treat any device or chat that may become evidence with care from the beginning. Log every action, avoid screenshots as your only proof, and involve digital forensic professionals early. For a real-world breakdown of best practices, my article on effective forensic collection will help you get started.
