Methodology & Integrity Verification

1. 1

   Read the file locally

   The WhatsApp export (.zip or .txt) is read into the browser tab’s memory. It is not uploaded.

2. 2

   Fingerprint the source

   Before anything else, the SHA-256 hash of the unmodified file is computed with the browser’s Web Crypto API.

3. 3

   List and fingerprint the archive

   For ZIP exports, every file in the archive is listed and hashed individually.

4. 4

   Parse the messages

   The chat text is read line by line. A new message starts at each line with a WhatsApp timestamp header; following lines are continuations of that message.

5. 5

   Interpret dates

   Day/month order is inferred from all dates in the file. If it is ambiguous, it is flagged and you can override it. Timestamps are reproduced as written — device local time, no time-zone conversion. You may declare the time zone in the case details.

6. 6

   Run consistency checks

   The checks below are run and their results listed for review.

7. 7

   Render the package

   The transcript, indexes and report PDF are generated locally. The source file is never modified.

What the hashes do not show: who wrote a message, whether its content is true, or that the export is complete. A matching hash shows a copy is unchanged since it was fingerprinted — nothing about what happened on the phone before the export.

Timestamp earlier than previous message

A message dated more than one minute before the one above it. Often caused by a phone clock change, travel across time zones or delayed delivery; it can also indicate that a file was edited.

Identical consecutive message

The same sender sent the same text twice in a row. Usually a double-send or forwarding; worth confirming against the device.

Referenced attachment missing from the ZIP

A message refers to a file that is not in the archive. Common when media was not downloaded on the phone or was deleted before export.

Files in the ZIP not referenced by any message

Extra files in the archive. May be harmless (e.g. contact cards) or may mean the archive was assembled or modified after export.

Media omitted markers

WhatsApp wrote “<Media omitted>” because the chat was exported without media or the media was unavailable.

Deleted-message markers

WhatsApp shows a placeholder where a message was deleted before export. The original content is not in the export.

Edited-message markers

The message was edited after it was sent. The export contains only the final version.

Gaps of 60 days or more

No messages for a long period. Useful context for a timeline; may also mean messages are missing from the export.

Ambiguous day/month order

Every date in the file fits both day-first and month-first formats. Confirm the interpretation against the phone; you can override it.

Unrecognized leading lines

Lines before the first timestamped message that could not be parsed. They are not included in the transcript.

The SOURCE hash depends only on the file, so any tool gives the same value. The TRANSCRIPT hash depends on the file and the parser: importing the same source file in the same software version reproduces the same transcript and the same hash. Every report records the software version (currently 2.1.0) and package format (evidence-package/2).

The REPORT hash identifies one specific PDF. Generating the package again creates a new PDF — with a new generation time and report ID — and therefore a new report hash, while the source and transcript hashes stay the same.

1. Open VERIFY.txt or integrity-manifest.json from the package and note the expected hashes.
2. Open a terminal in the folder containing the file you want to check and run:

   # macOS / Linux
   shasum -a 256 "WhatsApp Chat.zip"
   
   # Windows (PowerShell)
   Get-FileHash "WhatsApp Chat.zip" -Algorithm SHA256

3. Compare the output with the expected value. Upper or lower case doesn’t matter; every other character must match.
4. Repeat for the report PDF (REPORT hash) and, if needed, for individual attachments against the attachment index.
5. To check the TRANSCRIPT hash, rebuild the canonical text described above from the transcript CSV and hash it, or re-import the source file in the same software version.

• A WhatsApp export contains only what WhatsApp includes. Deleted messages, reactions, call logs, read receipts and device metadata are generally not present.
• WhatsApp caps the number of messages it exports (particularly with media). Completeness should be confirmed against the device.
• Display names come from the exporting device’s contact list. They do not identify account holders.
• Timestamps are shown as the device recorded them, in its local time. No time-zone conversion is applied.
• The PDF’s embedded font cannot draw emoji and some non-Latin scripts; these appear as code points such as [emoji U+1F602]. The CSV keeps the original characters.
• The software cannot prove who wrote a message, whether its content is true, or whether the device or export was manipulated before it was imported.
• Consistency checks flag items for human review. A flag is not a finding of tampering, and the absence of flags is not proof that nothing was altered.
• ScanMyChat cannot guarantee that any court will admit the package.