Guide · updated 1 September 2026

The limits of a WhatsApp export

Knowing what an export cannot establish is worth as much as knowing what it can. It is also the part your opponent will be reading most carefully.

An export is a snapshot, not a history

WhatsApp writes out the conversation as it stands at the moment you ask. It is not a log, not a forensic image of the device, and not a record maintained by anyone independent. Everything below follows from that.

What is not in the file

• Deleted messages. Deleted before the export, not in the export. Where the application records a deletion, the transcript shows that a message was deleted — not what it said.
• Disappearing messages that have already expired.
• Edit history. An edited message appears as its current text. The earlier version is not exported.
• Media no longer on the device, even on a with-media export. See the media omitted guide.
• Messages beyond the export limit. A long conversation is truncated from the older end, so the export may not start where the conversation started.
• Read receipts, online status, typing indicators, live location. None of it is written to an export.

What is in the file but proves less than it appears to

• Sender names. The export shows what the exporting phone had saved. It does not establish who was holding the other device.
• Timestamps. They come from the device clock. A wrong or altered clock produces wrong timestamps in a genuine export.
• Forwarded content. A forwarded message shows what was sent onward, not who originated it or when.
• Attachment filenames. The date in a filename is when the media was created, which for forwarded media is not when it was sent in this conversation.

And what the hash does not do

A SHA-256 fixes the file from the moment it was computed. Anyone can recompute it and confirm the file has not changed since. What it cannot do is show that the file came out of WhatsApp rather than a text editor — a hash of a fabricated transcript is a perfectly valid hash of a fabricated transcript.

That gap is real and it is the standing objection to every product in this category. It can be narrowed — a genuine export carries structural features an edited file loses, and those can be tested and reported — but it cannot be closed by software. It is why Part B exists, and why a court that genuinely doubts a record may want the device itself examined.

Saying so is the stronger position

An exhibit that quietly presents an incomplete record as complete is one discovery away from being worthless. An exhibit that states on its face how many entries refer to missing media, how many messages were recorded as deleted, and what the checks on the file did and did not establish, is harder to attack — because the attack has already been made and answered in the document.

---

This guide explains procedure and states the law as we understand it. It is not legal advice, and Aarohan Enterprises is not a law firm. Whether a court admits a particular record, and what weight it gives it, is for that court to decide. Have an advocate settle anything you intend to file.