THE FORENSIC EVIDENTIARY VALUE OF END-TO-END ENCRYPTED MESSAGING A Technical and Legal Analysis of WhatsApp, Signal and Telegram Records Review Article End-to-End Encryption • Digital Forensics • Evidence Integrity • Unlawfully Obtained Evidence • Endpoint Examination • Cloud Backup • CMK Art. 134 ABSTRACT End-to-end encryption (E2EE) has become the standard in contemporary messaging applications and, while strengthening communication privacy, has largely rendered traditional interception methods inoperative. This has produced a paradigm shift for digital forensics: evidence must now be obtained not from the communication channel but from its endpoints — that is, from devices and cloud backups. This article examines the value of WhatsApp, Signal and Telegram records as forensic evidence along three axes: (i) the technical foundations of end-to-end encryption and the distinction between content and metadata; (ii) the methods of obtaining messaging data through endpoint examination, cloud backups and forensic tools, together with the reliability and integrity of that data; and (iii) the legal standing of the resulting evidence under Turkish law and international case law. Recent judgments of the Court of Justice of the European Union and national courts on the admissibility of evidence obtained by dismantling encrypted networks such as EncroChat and Sky ECC are assessed, and the manipulation risk of screenshots discussed. In the Turkish context, the conditions under which encrypted message records will be deemed lawful evidence are set out within the framework of Articles 134 and 135 of the Code of Criminal Procedure, the prohibition of unlawfully obtained evidence and the recent case law of the Court of Cassation. The study argues that encrypted message evidence will be reliable before a court only when it is lawfully obtained, its technical integrity verified and the chain of custody preserved. Keywords: end-to-end encryption, digital forensics, messaging applications, evidence integrity, unlawfully obtained evidence, endpoint examination, cloud backup, screenshot, CMK Art. 134, EncroChat.
ABSTRACT End-to-end encryption (E2EE) has become the standard in contemporary messaging applications and, while strengthening communication privacy, has largely rendered traditional interception methods ineffective. This has produced a paradigm shift for digital forensics: evidence must now be obtained not from the communication channel but from its endpoints -- that is, from devices and cloud backups. This article examines the evidentiary value of WhatsApp, Signal and Telegram records along three axes: (i) the technical foundations of end-to-end encryption and the distinction between content and metadata; (ii) the methods of acquiring messaging data through endpoint examination, cloud backups and forensic tools, together with the reliability and integrity of such data; and (iii) the legal standing of the resulting evidence under Turkish law and international case law. Recent judgments of the Court of Justice of the European Union and national courts on the admissibility of evidence obtained by dismantling encrypted networks such as EncroChat and Sky ECC are assessed, and the manipulation risk of screenshots is discussed. In the Turkish context, the conditions under which encrypted message records may be deemed lawful evidence are set out within the framework of Articles 134 and 135 of the Code of Criminal Procedure, the prohibition of unlawfully obtained evidence and the recent case law of the Court of Cassation. The study argues that encrypted message evidence is reliable before a court only when it is lawfully obtained, its technical integrity is verified and the chain of custody is preserved. Keywords: end-to-end encryption, digital forensics, messaging applications, evidence integrity, unlawfully obtained evidence, endpoint examination, cloud backup, screenshot, chain of custody, EncroChat.
1. Introduction The development of communication technology over the past decade has fundamentally changed the balance between privacy and oversight. Telephone calls and text messages once flowed centrally through operator infrastructure and could be intercepted by legal order. Today billions of people communicate through applications such as WhatsApp, Signal and Telegram, with messages whose content is encrypted end to end. End-to-End Encryption (E2EE) ensures that a message is readable only on the devices of the sender and recipient and that no party in between, including the application server, can decrypt the content. That design is a strong gain for communication privacy, but a fundamental challenge for criminal investigation.
The implication of that challenge for digital forensics is clear: the classic method of intercepting communications has been largely rendered inoperative by E2EE. Because the traffic passing through the middle of the communication channel is encrypted, evidence must now be obtained not from the channel but from the endpoints of the communication. In other words, the route to message content generally runs through the device that sent or received the message, or through the cloud accounts to which those devices back up their data. That shift redefines both technical methods and the legal framework: device seizure, device search and access to cloud data have moved to the centre of investigation.
Messaging records are today submitted as evidence across a broad spectrum, from criminal proceedings to divorce cases and from commercial disputes to employment law. But the evidential value of those records depends on the answers to two basic questions. The first is lawfulness: was the record obtained by a lawful method? In Turkish law, unlawfully obtained evidence cannot form the basis of a judgment, under an absolute prohibition. The second is reliability/integrity: is the record genuine and unaltered? Screenshots in particular are weak evidence on their own, because they can easily be falsified. These two axes form the analytical framework of the article.
The subject is not purely technical; it has legal and ethical dimensions too. The admissibility of evidence obtained by dismantling encrypted networks en masse — as in the EncroChat and Sky ECC examples — is the subject of intense judicial debate in Europe. That debate lays bare the tension between the right to privacy, the right to a fair trial and effective criminal investigation. In Türkiye the Court of Cassation is developing ever more exacting case law on the lawfulness of message records obtained from devices. The remainder of the article is organised as follows. Section 2 explains the technical foundations of end-to-end encryption. Section 3 compares WhatsApp, Signal and Telegram. Section 4 examines the acquisition of message data by forensic methods; Section 5 the mass dismantling of encrypted networks. Section 6 covers screenshots and manipulation risk; Section 7 evidential integrity. Section 8 covers the legal framework, Section 9 the Turkish context and Section 10 recommendations for expert practice. Section 11 presents the conclusion. Throughout, no reference is made to any real file or person; only technical and legal awareness is intended.
2. The Technical Foundations of End-to-End Encryption To understand the forensic value of encrypted message evidence, one must first grasp how encryption works and at which points data remains accessible. This section addresses the basic mechanism of end-to-end encryption, modern protocol design and the critical distinction between content and metadata.
2.1. Encryption, Key Exchange and the Concept of the Endpoint Encryption is the process of converting a message into a form readable only by the party holding the right key. Two kinds of encryption are used together in modern messaging. Symmetric encryption both encrypts and decrypts with the same key and is fast; but it raises the problem of the parties sharing that common key securely. Asymmetric encryption (public key cryptography) gives each party a public and a private key pair; a message encrypted with the public key can be decrypted only with the corresponding private key. Applications use asymmetric methods for key exchange and symmetric methods for encrypting message content.
The distinguishing feature of end-to-end encryption is that encryption and decryption take place only on the users' devices — at the endpoints. The message is encrypted on the sender's device, carried across the network in encrypted form and decrypted only on the recipient's device. The application server sees the message only in encrypted form and cannot decrypt its content. The forensic consequence of that design is decisive: content cannot be intercepted mid-network; the route to content runs through the only place where the message exists decrypted, that is the endpoint device (or its backup). Figure 1 shows that flow and the points at which forensic access is possible.
Figure 1. Points of Forensic Access in E2EE Messaging (2025) 2.2. The Signal Protocol and Forward Secrecy The technical backbone of today's E2EE messaging is the open-source Signal Protocol. That protocol is used for message encryption not only in the Signal application but also in WhatsApp and other platforms. The protocol's most important feature is that it generates a separate encryption key for each message through the Double Ratchet algorithm. This provides two strong security properties: forward secrecy, meaning that the compromise of past keys does not reveal past messages; and future secrecy (or post-compromise security), meaning that the leak of one key does not compromise protection of future messages.
The forensic significance of that design is great. Each message being encrypted with a separate key, and those keys being continually renewed, makes it impossible to decrypt an entire correspondence with a single key obtained at one point. Passive interception and decryption of communications mid-channel is therefore practically impossible against modern protocols. That reality explains why forensic strategy inevitably turns towards the endpoint — the device or backup where decrypted data resides. The stronger the encryption, the more the centre of gravity of the evidence shifts to the device itself.
2.3. The Distinction Between Content and Metadata End-to-end encryption protects the content of a message but does not conceal the metadata of the communication to the same degree. Metadata is not 'what was said' but 'who communicated with whom, when, how often and for how long'. Who sent a message to whom, at what time, from which IP address, to which telephone number the account is registered — this information, though not content, is extremely valuable for an investigation. Communication network analysis can often produce meaningful relationship maps from metadata alone, without ever reaching content. Applications differ markedly in the amount of metadata they collect. Some adopt minimal metadata collection as a privacy principle, while others hold broader data on the communication network, device information and usage patterns. Forensically that distinction is critical: even where content is inaccessible, metadata or subscriber information obtainable from the service provider by legal means may carry evidential value on its own. In an investigation, therefore, the question must be not only 'can message content be obtained?' but also 'which metadata can be obtained by which legal instrument?'.
2.4. The Limits of Interception Classic lawful interception rests on intercepting the traffic flowing through operator infrastructure by legal order. That method remains functional for fixed and mobile telephone calls and unencrypted text messages; but it is largely ineffective against end-to-end encrypted messaging. Even if an operator or application server records the encrypted traffic flowing between two endpoints, it does not hold the key to decrypt the content. As a result, even where a lawful interception order has been obtained, the encrypted content cannot in practice be read; all that is captured is a meaningless stream of encrypted data.
That technical reality directly shapes forensic and legal strategy. To reach content, search and seizure on the device (CMK Art. 134) comes to the fore instead of interception of communications (CMK Art. 135), because content exists in decrypted form only at the endpoint. That shift is not merely a technical preference but means that different procedural safeguards come into play. The investigating authority must therefore determine from the outset the correct legal instrument — interception or search and seizure — according to the nature of the evidence sought. Choosing the wrong instrument is both fruitless and may render the evidence obtained unlawful. 3. A Comparative Analysis of the Applications WhatsApp, Signal and Telegram differ significantly in their technical design and privacy approach, and those differences directly affect the forensic accessibility of each. Figure 2 and Table 1 summarise the comparison.
Figure 2. The Privacy and Forensic Accessibility Profile of Messaging Applications (2025) 3.1. WhatsApp WhatsApp, the world's most widely used messaging application, encrypts message content end to end with the Signal Protocol by default. Forensically, WhatsApp's most critical characteristic is its cloud backup behaviour. Users can back up chat histories to Google Drive on Android and to iCloud on iOS. Historically those backups were held without additional end-to-end protection, unlike the correspondence on the device, which allowed backups to be decrypted through legal access to the relevant cloud account. Although WhatsApp subsequently added an optional end-to-end encryption setting for backups, many users do not enable it, so the cloud backup remains an important forensic source.
On the device, WhatsApp data is stored in an encrypted database; but the key to that database is generally also on the device. When an unlocked device is accessed lawfully, it is therefore possible to obtain correspondence, media files and contact lists with forensic tools. iOS and Android backups can also contain the WhatsApp message database if the password is known. Despite strong channel encryption, WhatsApp is therefore a forensically accessible application at the endpoint and cloud layers.
3.2. Signal Signal is an application placing privacy at the centre of its design and is the most challenging for forensic access. Signal adopts a principle of minimal metadata collection; the data held on the server side is extremely limited. The application encrypts the on-device database strongly and offers no cloud backup by default, which largely renders the 'search for data on the server or in the cloud' approach inoperative. Access to Signal data therefore depends almost entirely on the endpoint device — and on that device being unlockable. Forensic tools can decrypt and parse the Signal database from an unlocked device; but if the device is locked and the encryption keys cannot be obtained, Signal data remains practically inaccessible. That makes Signal strong on privacy and forensically solvable only on condition of physical device access and unlocking. The Signal example shows clearly that modern privacy design reduces forensic access to the device lock.
3.3. Telegram Telegram is distinguished from the other two applications by an important structural difference: end-to-end encryption is not the default in Telegram. Standard 'cloud chats' are stored on Telegram's servers and protected by client-server encryption; but the content is technically accessible on the server side. End-to-end encryption applies only to 'secret chats' initiated specifically by the user, and those chats are stored only on the relevant devices. That design creates a two-sided forensic picture. On one hand, because Telegram's cloud chats are held on the server, they form a data pool theoretically obtainable from the service provider; but that depends on Telegram's policy on responding to legal requests and on the jurisdiction concerned. On the other hand, because secret chats are end-to-end encrypted and device-bound, they can be obtained only through endpoint examination. That most users use the default cloud chats makes Telegram — outside secret chats — relatively accessible forensically. Understanding that distinction correctly in an investigation is vital for determining which data can be obtained from where. Table 1. A Forensic Comparison of WhatsApp, Signal and Telegram Feature WhatsApp Signal Telegram Default E2EE Yes (all chats) Yes (all chats) No (secret chats only) Cloud backup Yes (Drive/iCloud) No (by default) Yes (cloud chats on the server) Content on the server No No Yes (cloud chats) Metadata level Moderate Minimal Moderate–high Forensic access route Device + cloud backup Device only (unlocked) Device + (cloud chats) Note. Compiled on the basis of application security documentation and the digital forensics literature. 3.4. Group Chats and the Multi-Device Problem A common technical difficulty across the three applications is group chats and multi-device support. A group chat may contain dozens of participants; each participant's device holds a copy of the correspondence in decrypted form. That is forensically both an opportunity and a source of complexity: while a record obtained from one participant's device may contain the whole group's correspondence, cross-verification of copies of the same correspondence on different devices strengthens the assessment of authenticity. On the other hand, multi-device support allows the same account to run simultaneously on several devices — phone, tablet, desktop — which means the evidence may exist at multiple points.
The multi-device architecture is also important for key management. Modern applications manage separate encryption keys for each device, and adding a new device to an account generally triggers a security notification for the other participants. Forensically, those notifications and device records can offer valuable traces showing which devices connected to an account and when. The expert must attend not only to message content but to this device and session metadata; those traces can often be as illuminating as the content. 4. Obtaining Messaging Data by Forensic Methods The routes to encrypted message data are determined by the points at which the data exists in decrypted form. This section addresses four main approaches: endpoint examination, cloud backups, forensic tools and the special case of disappearing messages.
4.1. Endpoint Examination Endpoint examination is the forensic examination of the device — smartphone, tablet or computer — on which message data exists in decrypted form. This is the most direct and reliable source of evidence in the E2EE era, because the message is already present at the endpoint in the clear. The success of the examination depends largely on two conditions: physical access to the device and the ability to unlock it. On an unlocked device the databases, media folders and caches of messaging applications can be extracted forensically. On a locked device, access may or may not be possible depending on the device model, operating system version and available forensic methods.
Forensic principles must be applied rigorously in endpoint examination. The examination should be conducted with as little change to the device's state as possible; a cryptographic hash of the data image obtained should be taken and the examination documented reproducibly. In Turkish law such an examination is as a rule subject to the provisions on 'search, copying and seizure in computers, computer programs and records' under Article 134 of the Code of Criminal Procedure; procedural irregularity can render the evidence obtained unlawful.
4.2. Cloud Backups Where direct access to the device is not possible, cloud backups offer a critical alternative. Users often back up messaging data to a cloud account — a Google account or Apple iCloud. Depending on the application and user settings, those backups can contain a correspondence history close to that on the device. Access to a cloud backup rests on a lawful request directed to the relevant cloud service provider or on obtaining the user's credentials lawfully.
The cloud layer is where the differences between applications appear most clearly. WhatsApp backups are a rich forensic source, particularly where the optional backup encryption is not enabled. Because Signal offers no cloud backup by default, that route is generally closed for Signal. Telegram's cloud chats, already held on the server, arise with a different legal dynamic — obtaining them from the service provider. At the outset of an investigation, therefore, correctly understanding the target application's cloud behaviour determines which legal instrument will be used.
4.3. Forensic Tools Extracting and parsing messaging data from a device or backup is carried out with specialised digital forensics tools. Widely used tools in the sector include Cellebrite UFED, Oxygen Forensic Detective and Magnet AXIOM. These tools combine data extraction from supported devices, decryption of encrypted databases, parsing of correspondence and reporting. For example, the Signal database can be extracted from an unlocked device; if the encryption keys are available, encrypted databases can be parsed. Table 2 summarises the typical capabilities of these tools. Table 2. Typical Capabilities of the Principal Mobile Forensics Tools Tool Distinguishing Capability Typical Use Cellebrite UFED Broad device support, data extraction Law enforcement, forensic laboratory Oxygen Forensic Detective Application parsing, cloud access Forensic examination, application data Magnet AXIOM Evidence correlation, reporting Integrated analysis, timeline Note. Compiled on the basis of the tools' public documentation. The comparison is not promotional; capabilities vary by version and device.
The power of these tools also creates a responsibility. A tool saying it 'extracted the messages' does not mean those messages were lawfully obtained or are authentic. The expert must document from which device, by which method and with which key material the tool extracted data, and must assess critically the possible errors and interpretations in the tool's parsing process. The tool does not replace the expert; it is an aid the expert uses. 4.4. Disappearing (Ephemeral) Messages Modern messaging applications offer a 'disappearing message' feature deleting messages automatically after a set period. That feature creates a particular forensic difficulty, because the message is by design not stored permanently. For a time, leading forensic tools did not officially support the recovery of such messages; but capabilities for recovering disappearing messages in certain scenarios have since been developed. Even so, disappearing messages are a far more fragile source of evidence than permanent ones, and their absence does not mean an event did not take place. Disappearing messages highlight the relationship between the transience of evidence and the timing of forensic intervention. The earlier and more correctly a device is seized, the greater the probability that disappearing content can be recovered through caches, notification records or partial traces. That once again underlines the importance of forensic preparedness and rapid intervention. 4.5. Live and Cloud Forensics Traditional digital forensics rests on the principle of shutting down the device, taking a copy (an image) and working on that copy. But in the era of encrypted messaging that 'dead-box' approach is not always sufficient. When a device is shut down or locked, keys and data held decrypted in memory may be lost. In some cases live forensics — obtaining data from memory in accordance with proper procedure while the device is running and unlocked — may therefore be critical. Live examination allows volatile data to be captured; but because it changes the device's state it requires maximum rigour and documentation.
Cloud forensics covers situations where the data resides not on the device but on remote servers. When lawful access to a user's cloud account is obtained, message backups, media files and account activity records can be acquired. Cloud forensics opens an invaluable route where physical access to the device is impossible; but cross-border data access is subject to the legal requirements of different jurisdictions and to provider policies. These two approaches — live and cloud forensics — are parts of a contemporary repertoire of evidence acquisition complementing the classic device image method.
5. Mass Intervention Over the Network: EncroChat, Sky ECC and ANOM Alongside endpoint-focused methods, law enforcement has in recent years conducted large-scale operations targeting encrypted communication networks en masse. The EncroChat, Sky ECC and ANOM examples reveal both the power of that approach and the deep legal debates it generates.
EncroChat and Sky ECC were closed platforms specialising in encrypted communication and widely used in organised crime circles. In 2020 and 2021 law enforcement infiltrated the infrastructure of those networks and succeeded in accessing users' messages — at the endpoint, before the encryption was applied — collecting millions of messages. ANOM (Operation Trojan Shield) operated on a different logic: law enforcement spread an encrypted messaging application under its own control through criminal circles from the outset, monitoring communications at source. These operations resulted in numerous arrests and seizures.
But the admissibility of that evidence in court has been the subject of intense legal debate. The fundamental problem is whether the method by which the evidence was obtained — en masse, across borders and closed to defence scrutiny — is compatible with the right to a fair trial. In its EncroChat judgment of 30 April 2024 (C-670/22, M.N.) the Court of Justice of the European Union (CJEU) held that the admissibility of evidence is a matter for national law, but that the assessment must be consistent with the provisions of the EU Charter of Fundamental Rights on fair trial and defence rights (CJEU, 2024). Following the CJEU's judgment, national courts have reached differing conclusions. That divergence shows strikingly how the same type of evidence can be assessed differently in different legal systems. Table 3 offers a summary of recent decisions in various European countries.
Table 3. Some Recent Decisions on EncroChat / Sky ECC Evidence (2024–2025) Jurisdiction Approach Outcome CJEU (C-670/22) Admissibility is a matter for national law Requirement of consistency with fair trial Germany (Berlin Regional Court) Contrary to national and EU law Evidence excluded Austria (OGH) Cross-border investigation without national basis Inadmissible Switzerland (Zurich Higher Court) Examination without prior authorisation Inadmissible United Kingdom Compliance with national procedure Evidence admitted Note. Compiled on the basis of publicly available legal analyses of court decisions of 2024–2025. Decisions may change on appeal and with new case law. Another instructive dimension of these operations is the problem of the auditability of the evidence. Because the messages in EncroChat and Sky ECC were collected by law enforcement's technical methods, the defence has often been unable to verify independently how the data was obtained, what its raw form was and whether its integrity was preserved during collection. Yet one of the basic requirements of a fair trial is that evidence against the accused can be tested by the defence. Behind the exclusion of the evidence by some national courts lies precisely this problem of unauditability: however strong the content of the evidence, if its acquisition and integrity cannot be verified by the defence, a court cannot rely on it with confidence. That principle again underlines that technical method must be balanced with legal legitimacy.
The EncroChat and Sky ECC experience summarises the fundamental tension at the intersection of digital forensics and law: a technically powerful and effective evidence-gathering method cannot acquire value before a court without passing through the filter of legal legitimacy. That evidence 'can be obtained' does not mean it is 'usable'. That lesson applies directly in the Turkish legal context too.
6. Screenshots and Manipulation Risk In practice message evidence is most often submitted to a court in its simplest form — as a screenshot. Although a screenshot is practical and accessible, it is the weakest form in terms of evidential reliability. The reason is clear: a screenshot is a static image severed from the original data and abstracted from its context, and it can be produced or altered extremely easily with today's tools.
The manipulation risk is multifaceted. A correspondence can be altered with image editing software; a fake conversation can be produced from scratch by imitating a real interface; even the date, time or party information of a real message can be distorted. The spread of AI-assisted generation tools has increased that risk further. A screenshot should therefore not be accepted as strong evidence on its own and unverified. A screenshot's value emerges only when it can be linked to the original source that produced it — the database on the device, or the server or cloud record.
Good forensic practice therefore requires not settling for a screenshot wherever possible, but obtaining the data from its original source, by forensic method and in a form whose integrity can be verified. The authenticity of a message must be assessed not only by its visual content but by the metadata at its source (creation time, sender/recipient identifiers, database structure) and the internal consistency of that metadata. A screenshot is at best an initial indication; the real evidence is the original record that verifies it.
The maturing of AI-assisted generation tools has made the reliability of screenshot evidence still more contested. Producing a realistic-looking fake correspondence interface is today a matter of a few minutes; altering particular messages in an existing correspondence can even be done without a trace. That development shows that the attitude of 'I believe what I see' is no longer valid in a forensic context. A screenshot looking genuine does not prove that it is genuine; on the contrary, visual plausibility is today the most easily produced quality. Authenticity can therefore be established not by visual impression but only by technical examination of the original source and its metadata.
This picture makes the role of the digital forensics expert still more central. In an environment where manipulation grows ever easier, the expertise to assess the genuineness of a message not merely by looking at its content but by examining the database structure at its source, the internal consistency of the metadata and any cross-sources is the last guarantee of evidential reliability. It is of increasing importance for fair trial that courts move away from relying on unverified screenshots and make forensic examination based on the original source the standard.
6.1. Steps in Assessing a Screenshot When only a screenshot is submitted to a court, the expert should follow an order of assessment. The following steps offer a minimum framework for measuring a screenshot's reliability:
• Question the source: from which device and which application was the image taken; is the original record still accessible?
• Visual consistency: are the interface elements, fonts, time format and alignments consistent with the actual version of the relevant application?
• Metadata examination: does the image file's own metadata (creation time, traces of editing) match the claimed time of the event?
• Comparison with the original source: where possible, compare directly with the database record on the device; inconsistency is a sign of manipulation.
• Cross-source: do the other party's device, a cloud backup or a third witness record confirm the same correspondence?
• Contextual integrity: does the image show an uninterrupted portion of the correspondence, or selected and combined fragments?
None of these steps gives a definitive result on its own, but applied together they reveal meaningfully the level of reliability of a screenshot. The critical principle is this: until verified, a screenshot is no more than an assertion; its evidential value arises only to the extent it can be linked to the original source. That approach both prevents wrongful convictions and enables genuine evidence to carry the weight it deserves.
7. Evidential Reliability and Integrity The strength of message evidence before a court depends on two qualities being present together: authenticity (that the evidence genuinely comes from the claimed source and has not been altered) and integrity (that the chain of custody has been preserved from seizure to presentation). This section addresses how those two qualities are secured.
7.1. Authenticity and Metadata Verification The most reliable way of assessing the authenticity of a message record is to examine it at its original source. The message database on the device contains not only message text but the send/receive timestamp of each message, sender and recipient identifiers, message status information and the internal structural relationships of the database. That metadata offers a rich basis for verifying the authenticity of a message; for example, the consistency of a message's timestamp with other records in the database can reveal signs of manipulation. Unlike a screenshot, the original database offers evidence whose internal consistency can be tested. The assessment of authenticity is also strengthened by the cross-verification of several sources. When the record on one party's device is compared with the record on the other party's device or with a cloud backup, consistency supports authenticity while inconsistency raises suspicion of manipulation. That cross-verification is a critical method for revealing the true value of the evidence, particularly in private law disputes where the parties submit only screenshots.
7.2. The Chain of Custody and Hash Verification The chain of custody is the uninterrupted documentation of every stage a piece of digital evidence passes through from the moment it is obtained to the moment it is presented in court. For message evidence, that chain begins at the moment the device is seized. A cryptographic hash of the seized device or the extracted data image must be taken; that digest serves as a seal proving mathematically that the evidence has not subsequently been altered. Every stage of the examination — who did what and when — must be recorded. Hash verification is the basic guarantee of the integrity of digital evidence. The hash value of the data image obtained must remain unchanged throughout the examination; any change alters the hash value fundamentally and is thereby detectable. A good forensic report documents explicitly the hash algorithm used, the hash values taken and the verification steps. That rigour ensures the technical finding survives if the evidence is challenged in court; its absence can weaken the legal value of even a technically correct finding. 7.3. The Expert Report and Presentation in Court Even message evidence obtained soundly in technical terms and verified for integrity does not reach its full value unless presented to the court intelligibly and defensibly. An expert report must satisfy three audiences at once — the technical expert, the lawyer and the judge. It must therefore set out the method used (which device, which tool, which extraction method), the integrity of the data obtained (hash values, chain of custody) and the basis for the conclusions reached, in language a non-technical reader can follow. A good report presents not its assertions but its observations and their bases; it separates interpretation from fact with care.
Another responsibility of the report is to state uncertainties and limits honestly. If the authenticity of a message cannot be verified definitively, that must be stated explicitly; a probabilistic assessment must not be presented as a definitive finding. Likewise, data that could not be obtained — a device that could not be unlocked, a deleted backup, disappearing messages — must be noted in the report, because the absence of data is often open to misinterpretation. The expert's value in court comes less from the certainty of their findings than from their methodological honesty and a humility aware of limits. That the defence can test the report — as required by the principle of equality of arms — is a direct consequence of that transparency.
8. The Legal Framework The value of encrypted message evidence is ultimately determined within a legal framework. This section addresses the subject first under Turkish law and then in terms of international case law. Figure 3 shows a decision flow assessing whether evidence was obtained lawfully. Figure 3. The Decision Flow for Obtaining Encrypted Message Evidence (2025) 8.1. Turkish Law: The CMK, Unlawful Evidence and Court of Cassation Case Law In Turkish criminal procedure law, the acquisition of digital evidence is governed principally by Article 134 of the Code of Criminal Procedure (CMK) — 'search, copying and seizure in computers, computer programs and records'. Under that article, searching computers and similar devices used by a suspect is as a rule subject to a judicial order on the application of the public prosecutor. Interception of communications is governed separately by Article 135 of the CMK. These procedural safeguards serve as a fundamental protection against arbitrary interference.
One of the most decisive principles of Turkish law is the prohibition of unlawfully obtained evidence. Under Article 38 of the Constitution and Articles 206/2-a and 217/2 of the CMK, evidence obtained by unlawful methods is rejected and cannot form the basis of a judgment. That prohibition is accepted in doctrine and case law as absolute; that is, however important the content of the evidence, it cannot form the basis of a conviction if it was obtained unlawfully. That principle means that the method by which message evidence was obtained is as important as — indeed more important than — its content.
The Court of Cassation is developing ever more exacting case law on the lawful acquisition of message records. Thus in a decision of 15/05/2024 (case no. 2023/15758, decision no. 2024/18787) the 10th Criminal Chamber of the Court of Cassation stressed that examining the message records on a telephone handed over by a suspect — even voluntarily — under the heading of a 'preliminary examination and custody record', without a judicial order or written prosecutorial instruction under Article 134 of the CMK, is procedurally unlawful, and that evidence so obtained is deemed unlawful and cannot form the basis of a judgment. That decision makes concrete how critical procedural safeguards are in endpoint examination.
In private law, the evidential value of message records is subject to a different dynamic. Under the settled approach, where a person has themselves recorded a correspondence to which they are a party, without unlawful interference, it is considered possible for them to submit that record as evidence. Conversely, secretly intercepting a communication to which one is not a party, or obtaining third parties' correspondence unlawfully, both falls foul of the evidence prohibition and may constitute an offence. That distinction is frequently confused in practice and must be assessed with care.
8.2. International Case Law: The CJEU and Fair Trial Internationally, the admissibility of encrypted message evidence is debated around the right to a fair trial. The CJEU's EncroChat judgment (C-670/22), addressed in Section 5, is the landmark of that debate: while leaving admissibility to national law, the judgment stressed that the assessment must respect defence rights and the principle of equality of arms. In particular, the defence's ability to scrutinise the process by which the evidence was obtained and its raw data emerges as a requirement of fair trial (CJEU, 2024). Article 6 (the right to a fair trial) and Article 8 (the right to respect for private life and correspondence) of the European Convention on Human Rights form the foundation of the international standard in this field. In the case law of the European Court of Human Rights, although the unlawful acquisition of evidence is not always a violation in itself, what matters is whether the proceedings as a whole were fair; the defence's ability to challenge and test the evidence is decisive. Assessed together with the absolute evidence prohibition in Turkish law, that standard establishes that both the method of acquisition of message evidence and its auditability by the defence must be rigorously guaranteed.
8.3. The Common Principle: The Balance of Method and Legitimacy Although Turkish law and international case law use different conceptual instruments, they meet in a common principle: the technical strength of evidence does not substitute for its legal legitimacy. The absolute prohibition of unlawfully obtained evidence in Turkish law and the fair trial guarantee in European case law serve the same aim — restraining arbitrary and unauditable methods of obtaining evidence — by different routes. That common principle has a practical consequence for the digital forensics expert: that evidence can technically be obtained is only half the task; the other half is the conformity of that method with legal safeguards and the defence's right of scrutiny. That balance also points the way for the future of digital forensics. As encryption strengthens, law enforcement tends towards more intrusive technical methods — device exploitation, endpoint infiltration, bulk data collection. But each of those methods generates new tensions with privacy and fair trial rights. A sustainable balance lies in a framework that neither absolutises privacy nor paralyses criminal investigation, but rests on a clear legal basis, judicial oversight and auditability by the defence. The expert's role is to secure the technical leg of that framework — the transparency of the method and the testability of the finding.
9. The Turkish Context and Practice Türkiye is a country in which messaging applications are used intensively, which means message records arise as evidence in almost every kind of proceeding. In criminal proceedings the procedural propriety of endpoint examination, and in private law whether the record was obtained by a party and lawfully, are the most frequently encountered points of debate in practice.
Part of the debate in Turkish law about encrypted messaging also concerns whether the use of particular applications can itself count as evidence. Such debates show how closely technical determination and legal assessment are intertwined: an application being installed on a device does not mean the device's owner possessed particular communication content; the existence and nature of the content must be established by separate and rigorous technical examination. Not confusing the limits of technical determination with legal conclusions is one of the digital forensics expert's most basic responsibilities.
Capacity and training are among the decisive needs of the Turkish context. The correct acquisition and assessment of encrypted message evidence requires experts who both command current forensic tools and know the subtleties of procedural law. Errors such as failing to observe the CMK Article 134 safeguards in endpoint examination, accepting a screenshot without the original source, or failing to document the chain of custody can render technically obtained evidence legally worthless. The establishment of a common methodological standard at the level of law enforcement, prosecution and expert witnessing is therefore of critical importance both for reaching the material truth and for fair trial.
Another prominent difficulty in Turkish practice is cross-border data access. Because the principal messaging providers are established abroad, access to metadata or server-side data depends on international mutual legal assistance processes and providers' policies on legal requests. Those processes can be time-consuming, which explains why endpoint examination — direct access to the device — plays such a central role in Turkish practice. Device-centred evidence is often the fastest and most direct route; but precisely for that reason it is the area in which procedural safeguards demand the greatest attention.
9.1. A Representative Practical Scenario To make the concepts concrete, let us consider a wholly representative scenario making no reference to a real file. In a dispute one party claims that the other sent them threatening messages and submits only a few screenshots as evidence. The first question is not lawfulness but reliability: because these screenshots can easily be produced, they are weak evidence on their own. The correct approach is to go beyond the screenshot and reach the original source of the message — the database on the claimant's device.
In the second stage the claimant's device is taken for forensic examination with their consent and in accordance with proper procedure. The message database on the device can confirm or refute the correspondence in the screenshot, including send timestamps, party identifiers and the internal consistency of the database. Where possible, cross-verification with the corresponding record on the other party's device strengthens authenticity further. At this stage the expert does not merely say 'the message exists'; they also assess whether the message's metadata is consistent and whether it bears signs of manipulation.
In the third stage all findings are turned into a report. The report documents the device examined and the hash value of the data image; sets out the consistency between the screenshot and the original record; and states explicitly any uncertainties — for example if cross-verification could not be carried out. This scenario illustrates the article's main thesis: a screenshot may be an initial indication, but the real evidence is the original record that verifies it; and the value of that record depends on its lawful acquisition, its integrity and its transparent reporting. This scenario is purely illustrative and relates to no real file or person. 10. Expert Practice and Good Practice Recommendations The assessments above point to a set of good practice principles the expert and the investigating authority should observe in handling encrypted message evidence: • Give priority to procedure: before turning to the content of the evidence, assess whether it was obtained lawfully (CMK Arts. 134/135, judicial order); procedurally improper evidence cannot form the basis of a judgment.
• Go to the original source: do not settle for a screenshot; reach the original database on the device or the cloud backup by forensic method wherever possible. • Document integrity: take a hash from the moment of seizure, record the chain of custody without interruption and report the examination reproducibly.
• Verify metadata: investigate signs of manipulation by testing the message's timestamp, party identifiers and the internal consistency of the database.
• Cross-verify: where possible, support authenticity by comparing multiple sources (two devices, device + backup).
• State limits explicitly: the absence of disappearing messages does not prove an event did not occur; express the limits of technical determination honestly in the report.
• Separate the technical from the legal: do not confuse the presence of an application with the presence of content; separate the technical finding carefully from legal characterisation.
These principles apply not only to criminal proceedings but to every kind of dispute in which message records are used as evidence. An employee's correspondence in an employment dispute, messages between spouses in a divorce case, negotiation records in a commercial dispute — the same two questions apply to all: was the record obtained lawfully, and is it authentic? Despite procedural differences between private and criminal law, the principle that evidence must rest on an original source and that its integrity must be verifiable is common. The good practice recommendations above therefore constitute a basic standard regardless of the branch of the judiciary in which the expert serves.
The common denominator of these principles is the combination of technical competence with legal rigour and methodological transparency. Encrypted message evidence, when correctly obtained and correctly assessed, is strong and reliable evidence; when mishandled it can become a source that both damages fair trial and misleads technically. The expert's task is to display the rigour that determines the difference between those two outcomes.
11. Conclusion End-to-end encryption, while strengthening communication privacy, has forced digital forensics into a fundamental transformation. Evidence is now obtained not from the communication channel but from its endpoints — devices and cloud backups. WhatsApp, Signal and Telegram present different forensic profiles in that picture: WhatsApp is relatively accessible through cloud backups, Signal can be decrypted only when the device lock is opened, and Telegram occupies a distinctive position because of its default cloud chats. Understanding those differences correctly is decisive for determining which data can be obtained from where.
Even so, that evidence 'can be obtained' does not mean it is 'usable'. As the EncroChat and Sky ECC experience shows, a technically powerful method of obtaining evidence cannot acquire value before a court without passing through the filter of legal legitimacy — fair trial and defence rights. The absolute prohibition of unlawfully obtained evidence in Turkish law and the recent case law of the Court of Cassation establish clearly that the method by which message evidence was obtained is as important as its content.
Another pattern this article sets out is the continuous interaction between technology and law. As encryption strengthens, forensic methods shift towards the endpoint, the cloud and live examination; and each new method raises new legal questions — privacy, proportionality, the defence's right of scrutiny. The spread of AI-assisted manipulation has made the assessment of authenticity far more critical than before and has shaken confidence in superficial evidence such as screenshots. In that environment the role of the digital forensics expert is more central and more responsible than in the past, because the competence to assess the genuineness of a message beyond the surface is increasingly becoming the last guarantee of evidential reliability.
Ultimately, the reliability of encrypted message evidence depends on three conditions being met together: lawful acquisition, verification of technical integrity and preservation of the chain of custody. Reaching the original source of the data and documenting its integrity, rather than settling for easily manipulated forms such as screenshots, is a requirement both of fair trial and of reaching the material truth. The expert's responsibility is to set out a complex technical reality, without hiding its limits and with regard to the legal framework, with a clarity on which the judge can rely with confidence. When that balance is struck, the message records of the encrypted age become reliable witnesses of justice.
References Anglano, C. (2014). Forensic analysis of WhatsApp Messenger on Android smartphones. Digital Investigation, 11(3), 201–213. https://doi.org/10.1016/j.diin.2014.04.003 Cellebrite. (2025). Navigating the most widely used apps and messaging sources in investigations. Cellebrite DI Ltd.
Court of Justice of the European Union. (2024, April 30). Judgment in Case C-670/22 (M.N. — EncroChat). CJEU.
Europol. (2021). Operation Trojan Shield / ANOM: Global law enforcement operation. European Union Agency for Law Enforcement Cooperation.
Marlinspike, M., & Perrin, T. (2016). The Double Ratchet algorithm. Signal Foundation. https://signal.org/docs/ Oxygen Forensics. (2025). Oxygen Forensic Detective: Application and cloud extraction capabilities. Oxygen Forensics Inc.
Schneier, B. (2015). Applied cryptography: Protocols, algorithms, and source code in C (20th anniversary ed.). Wiley.
Tamma, R., Skulkin, O., Mahalik, H., & Bommisetty, S. (2020). Practical mobile forensics (4th ed.). Packt Publishing.
Constitution of the Republic of Türkiye No. 2709. (1982). Resmî Gazete (No. 17863). (Art. 38, principles relating to offences and penalties).
Code of Criminal Procedure No. 5271. (2004). Resmî Gazete (No. 25673). (Art. 134, search in computers; Art. 135, interception of communications; Arts. 206, 217, evidence prohibition). Court of Cassation, 10th Criminal Chamber. (2024, 15 May). Case no. 2023/15758, decision no. 2024/18787. (Unlawfully obtained telephone records).
European Convention on Human Rights. (1950). (Art. 6, the right to a fair trial; Art. 8, the right to respect for private life and correspondence).
Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet (3rd ed.). Academic Press.
National Institute of Standards and Technology. (2014). Guidelines on mobile device forensics (NIST SP 800-101 Rev. 1). U.S. Department of Commerce. https://doi.org/10.6028/NIST.SP.800-101r1 Magnet Forensics. (2025). Magnet AXIOM: Mobile and cloud evidence processing. Magnet Forensics Inc.
Cohen, C., & Park, A. (2023). Forensic analysis of ephemeral messaging applications: Disappearing messages or evidential data? Forensic Science International: Digital Investigation, 46, 301608. https://doi.org/10.1016/j.fsidi.2023.301608 Unger, N., Dechand, S., Bonneau, J., Fahl, S., Perl, H., Goldberg, I., & Smith, M. (2015). SoK: Secure messaging. 2015 IEEE Symposium on Security and Privacy, 232–249. https://doi.org/10.1109/SP.2015.22 Court of Cassation, Assembly of Criminal Chambers. (2021). Principles on the lawful acquisition of digital evidence. (Summary of decision).
Reitinger, N. (2025). Encrypted messaging and the future of digital evidence. Journal of Digital Forensics, Security and Law, 20(1).
