Deleted chats, messages recovered from a phone, and screenshots can carry significant weight in criminal proceedings, but they do not become reliable just because they are readable. If content is attributed to you, or if it must support your version of the facts, the concrete questions are different: which device does it come from, who extracted it, is the conversation complete, has the file been modified, is the indicated date verifiable?
I will explain how to distinguish the issue of authenticity from that of the acquisition of evidence. We will see why the absence of metadata does not automatically render a screenshot false, but may limit its probative force; why recovery after deletion requires controllable technical data; and what alternatives make sense when the original phone is no longer available.
A Screenshot Does Not Prove by Itself Who Wrote a Message
A screenshot shows what appears on a screen at a given time. It can reproduce an authentic chat, but it can also be incomplete, cropped, generated on a different account, inserted into an altered sequence, or associated with the wrong contact. For this reason, simply observing the text is not enough: it is necessary to understand whether there are external elements that connect its content to a conversation that actually existed.
Authenticity concerns at least three distinct profiles. The first is provenance: it is necessary to identify the device, account, or copy from which the data originates. The second is integrity: it serves to verify whether the conversation was preserved in its actual succession or whether messages, attachments, reactions, calls, or passages that change its meaning were deleted. The third is attribution: a name in the contact list, a telephone number, or a profile picture does not automatically prove who materially used the account.
Metadata helps, but does not solve everything. Date, time, file identifiers, device information, and creation methods can make a verification more precise. Their absence may prevent important comparisons, for example on chronology, time zone, or the moment the image was generated. However, it does not entail, by itself, the exclusion of the screenshot: the judge can compare it with other elements, such as the available device, messages received from the other party, contextual data, statements, and documents.
Acquiring a Chat and Assessing Its Authenticity Are Different Matters
A chat can be challengeable for two autonomous reasons. The first concerns the way it entered the proceedings: who produced it, who had access to the phone, whether a necessary measure was in place, and whether the judicial police activity respected the foreseen guarantees. The second concerns its reliability: even correctly acquired content may not prove what the prosecution or defense claims.
Recent jurisprudence of the Court of Cassation has given prominence to the correspondence nature of messages stored in a device. A 2024 ruling stated that emails, WhatsApp, and SMS kept in the phone's memory retain that nature and that, barring the loss of topicality regarding confidentiality, their acquisition follows the forms of seizure of correspondence provided for by Article 254 of the Italian Code of Criminal Procedure. Cassation Review, June 2024
Who produces the content also matters. The Court then distinguished the hypothesis in which one of the participants in the conversation delivers screenshots already in their possession from that in which the judicial police independently extract messages from the device. In a 2025 decision, referring to screenshots provided by a conversant, the Court ruled out the need for a seizure by the public prosecutor; in a 2024 decision, it instead deemed WhatsApp messages acquired by the judicial police with screenshots taken on their own initiative, without urgency and without a seizure decree, unusable. Cassation Review, March 2025 Cassation Review, October 2024
These distinctions do not offer an automatic formula such as “screenshot always usable” or “screenshot always null”. Instead, it is necessary to separate spontaneous delivery by someone participating in the chat, extraction from a seized phone, access to forensic copies, recovery from backups, and searches performed after deletion. The path of the data can affect both its usability and the concrete possibility of checking its origin.
What Changes If Messages Were Deleted and Then Recovered
The recovery of a deleted message poses an additional problem: deletion does not always equate to the total disappearance of the data, but the way the data re-emerges must be explainable. Content can come from the phone's residual memory, a backup copy, an application database, another device connected to the same account, or a previous export. These are not equivalent sources, because they can photograph different moments of the conversation.
A technically controllable recovery should make it possible to reconstruct, as far as possible, which medium was examined, when the extraction was performed, what data was found, and whether the result depends on operations that can modify the content or its temporal placement. A forensic copy is a technical duplication designed to allow checks without continuously working on the original. The hash value, that is, a code calculated on the file or copy, can help verify that the copy has not changed after calculation; however, it does not prove by itself either the author of the message or the truth of what is written in it.
If only the recovered text is produced, without indication of the device, the procedure used, or the data allowing a cross-check, the challenge should not stop at the generic assertion that the message is false. It is more useful to identify the precise point that is not verifiable: the chat sequence, the date, the account, the association between number and person, the presence of missing messages, the transition from the original medium to print, or the impossibility of repeating the check.
The Original Device Is Not Always Indispensable, But Its Absence Weighs Heavily
The original phone is often the most useful cross-check, because it can preserve the chat structure, attachments, application information, and other contextual elements. Not having it does not necessarily prevent using a conversation: copies, the recipient's devices, backups, or additional sources may exist. However, when the original is missing, the importance of explaining the provenance of the copy and seeking independent confirmations increases.
The case of a chat deleted from both phones but reconstructed only from cropped images is different from the case where a deleted message is present in an examinable technical copy and finds correspondence in the other interlocutor's device. In the first case, the margin of control is narrow; in the second, multiple sources can be compared. The availability of repeatable checks affects the quality of the challenge and the final assessment.
How to Set Up a Concrete Challenge in Criminal Proceedings
An effective challenge indicates what does not add up and why it matters. Simply saying that a chat could be manipulated is not enough to clarify the defect of the evidence. If the complete conversation is missing, it is necessary to explain which previous or subsequent passage could change the meaning of the phrase. If the identity of the author is doubtful, one must distinguish the formal heading of the telephone line from the actual use of the account. If the problem is recovery, the limits of the procedure and available data must be indicated.
The possible requests depend on the phase of the proceedings and the material already present in the files. Asking for the availability of the medium or technical copy, the acquisition of the native export of the conversation if it exists, the examination of the person who extracted or received the images, or the admission of a technical assessment can all take on significance. The technical verification must have a precise object: not a generic search for anomalies, but the comparison between files, devices, chronologies, databases, attachments, or concretely identified accounts.
Defensive investigations can offer tools to collect and document favorable elements. The discipline introduced by Law no. 397 of 2000 provides, among other things, for technical findings in accessing places and the formation of the defense counsel's file, with specific rules for documentation. Law no. 397 of 2000, defensive investigations The point is not to multiply documents, but to preserve data that can be subjected to control and cross-examination.
Errors to Avoid When a Chat Can Become Evidence
Do not modify the relevant medium. Resetting a phone, reinstalling the application, changing accounts, performing automatic cleanups, or repeatedly forwarding images can delete useful elements and make it harder to understand what the original state of the data was. If the device may be relevant in the proceedings, it is prudent to avoid unnecessary interventions before clarifying how to preserve it.
Nor is it useful to focus only on the single most unfavorable or most favorable message. A chat can be read differently in light of the complete conversation, attachments, actual date, and relationships between participants. Context is not a narrative detail: it serves to establish whether a phrase is a threat, irony, a response to previous content, a quote, or a message sent by others.
For a first orderly examination, it is useful to preserve what already exists without modifying it: the device, the images in their original version, any received files, indications of provenance, and connected communications. It is not advisable to create personal reconstructions of the chat as a substitute for the original data. If a technical comparison is required, I can help you define the point to submit to the consultant and connect it to the procedural issues the judge must decide.
Frequently Asked Questions
Can I challenge a screenshot even if it shows the date and time?
Yes, date and time alone are not enough. They can be a useful element, but it is necessary to understand which device they came from, whether the clock was correct, whether the image is complete, and whether the contact is reliably referable to the indicated person. The challenge must identify the missing or inconsistent data, not just limit itself to denying the existence of the chat.
Is a deleted and recovered chat worth less than a chat still on the phone?
There is no rule of automatic devaluation. Recovery can be very significant if the origin, procedure, and technical copy are controllable. However, compared to the chat still visible on the device, doubts about completeness, sequence, and dating may increase. What counts above all is whether the recovered content finds confirmation in other verifiable sources.
Does the lack of metadata make the message unusable?
No, not necessarily. The absence of metadata can make important verifications impossible and thus weaken the probative value of the file or screenshot. However, the judge can consider other confirmation elements. It is necessary to distinguish the admissibility of evidence from its reliability: they are connected planes, but do not coincide.
If the other interlocutor spontaneously delivers screenshots, is it always necessary to seize their phone?
Not always. The Court of Cassation examined the hypothesis of screenshots delivered by a participant in the conversation, excluding, in the decided case, the need for a public prosecutor's seizure. However, authenticity, integrity, and context still need to be verified. The situation in which investigators directly extract messages from the device is different.
Can I prove that a WhatsApp account was not used by me?
It is possible to challenge the attribution of the account. The registration of a SIM card or the name shown in the contact list do not automatically coincide with the identity of the person who wrote. The availability of the phone, logins, use by third parties, connected devices, and contextual data can take on significance. The requested evidence must concern the concrete fact that makes the attribution doubtful.
Institutional References Used
For the topic of acquiring messages stored in devices, I used the reviews of the Court of Cassation relating to decisions filed in June and October 2024 and March 2025. References to defensive investigations derive from Law no. 397 of 2000 published on Normattiva.