Rubén Planes LlinaresDigital forensics expert witness

WhatsApp forensic expert in Barcelona

I analyse WhatsApp chats, voice notes and screenshots so you can submit them in court with confidence, or so you can challenge the ones the other side submits.

Member of AEPEJU (no. 1556). Barcelona and across Spain.

Indicative fee: from €300. See prices

Scroll

Is a screenshot enough?

No. A screenshot is just an image. It can be cropped, edited or fabricated in minutes with apps that generate fake chats, and the other side knows it.

If its authenticity is challenged, Spanish Supreme Court judgment 300/2015 of 19 May made it clear that the burden of proof shifts to whoever submits the conversation, and that the usual way to meet it is an expert report identifying the origin of the communication, the participants and the integrity of the content. Later case law has nuanced that this is not always essential if other evidence corroborates the chat, but relying on that is a risk when the chat is your main evidence.

In civil proceedings, the Spanish Civil Procedure Act (LEC) allows these instruments to be submitted (articles 299.2 and 384) together with the expert reports that prove their authenticity (article 382.2).

How is a WhatsApp conversation certified for court?

With an expert report that checks the conversation against the phone or its backup, never against a screenshot. The expert acquires the data without altering the device, calculates the SHA-256 hash of everything obtained, adds an RFC 3161 timestamp and transcribes the relevant messages with their date and time.

The result is a document that any expert for the other side can verify by repeating the hash calculation. That is what turns a chat into evidence that is hard to challenge.

What I analyse

  • The conversation on the phone itself: consistency of the message database, identifiers, timestamps and delivery status.
  • Encrypted WhatsApp backups, decrypted with the key provided by their owner.
  • Voice notes, photos and videos: integrity of each file against the record kept by the app.
  • Screenshots submitted by the other side: signs of editing or of fake chat generators.
  • Deleted or edited messages, when the device still holds traces.
  • Telegram, Signal and iMessage, with the same method.

How I work

I carry out a logical and backup extraction, without rooting or altering the device. I calculate the SHA-256 hash of everything obtained, add an RFC 3161 timestamp and document the chain of custody following UNE 71506, ISO/IEC 27037 and RFC 3227.

The result is reproducible: any expert for the other side can repeat the verification and obtain the same hashes. You normally get your phone back as soon as the acquisition is finished.

What you receive

  • A signed expert report with clear conclusions and no unnecessary jargon.
  • A transcript of the relevant conversation, with the date and time of each message.
  • An appendix of hashes so the court or the other side can verify everything.
  • Testimony in court if needed, quoted from day one.

Mistakes to avoid

  • Forwarding or exporting the conversation and then deleting the original.
  • Changing phone or restoring a backup before the analysis.
  • Clearing the chat or leaving the group where the messages are.
  • Accessing someone else's phone without permission: it can invalidate the evidence and have criminal consequences.

Frequently asked questions

Common questions about this kind of report.

Is a WhatsApp screenshot valid evidence in a Spanish court?

It can be submitted, but if the other side challenges it, it loses weight until someone proves its authenticity. The expert report checks it against the phone or the backup and certifies its integrity with verifiable hashes.

Do I have to hand over my phone?

Ideally the device holding the conversation, or its backup, is examined. The acquisition is done with your consent and the phone comes back to you when it is finished.

Can deleted messages be recovered?

Sometimes. It depends on the model, the system version, the time elapsed and whether backups exist. I tell you before quoting, not afterwards.

Can you examine a chat on someone else's phone?

Only with their permission or a court order. The usual approach is to examine your own device, which holds the same conversation.

Do you work in English?

Yes. I work in English, Spanish, Catalan and French. The report for a Spanish court is written in Spanish, and I can explain it to you in English.

How long does the report take?

Seven days for standard cases. The quote is free, arrives within 24 working hours and the deadline is put in writing.

Tell me about your case

Free 30-minute consultation and a free quote within 24 working hours.

Do not include sensitive data. Case details are requested later through a secure channel.

Free consultation WhatsApp