Deleted Texts, WhatsApp, and Off-Channel Messages: Preservation Risk Is Now a Litigation Issue
- Alethean Group, Inc.
- Jul 16
- 6 min read
Deleted messages are no longer a side issue in litigation. They are often the issue.
For years, parties treated text messages, WhatsApp chats, Signal messages, Slack threads, Teams chats, and other “informal” communications as secondary to email.
That distinction no longer holds up. Business conversations happen on mobile devices and messaging apps every day. Courts, regulators, and opposing counsel understand that. When those communications are missing, deleted, auto-expired, or never collected, the preservation question becomes unavoidable.
The practical issue is simple: if relevant communications happened off-channel, counsel needs to know where they occurred, whether they still exist, how they can be preserved, and what the absence of those messages means.
Off-channel does not mean off-limits
“Off-channel” usually refers to business-related communications that occur outside approved, archived, or routinely collected systems. That can include:
SMS and iMessage
WhatsApp
Signal
Telegram
Facebook Messenger
Instagram direct messages
Slack, Teams, Google Chat, and other collaboration tools
Personal email accounts
Messages on secondary phones, tablets, or laptops
Communications through shared accounts or family/cloud-linked devices
The problem is not limited to regulated financial institutions. Commercial litigation, employment disputes, internal investigations, white-collar matters, partnership disputes, restrictive covenant cases, harassment claims, trade secret disputes, and corporate investigations all increasingly involve messages that were sent outside formal systems.
A legal hold that only covers email and shared drives is no longer enough.
Public enforcement has made the risk concrete
The SEC’s off-channel communications enforcement actions show how serious this issue has become. In August 2024, the SEC announced charges against 26 broker-dealers, investment advisers, and dual registrants for widespread failures to maintain and preserve electronic communications. The firms agreed to pay more than $390 million in combined civil penalties. The SEC stated that personnel used unapproved communication methods and that the failure to maintain and preserve required records deprived the SEC of communications in its investigations.
That enforcement activity continued into 2025. In January 2025, the SEC announced another set of settlements involving nine investment advisers and three broker-dealers, with combined civil penalties of $63.1 million. The SEC again focused on unapproved communication methods and failures to preserve communications required under federal securities laws.
The DOJ and FTC have also made preservation of ephemeral and collaboration messages explicit. In January 2024, the agencies updated standard preservation language for second requests, voluntary access letters, compulsory process, and grand jury subpoenas to address collaboration tools and ephemeral messaging platforms. Their position was direct: communications created through modern messaging platforms are within preservation obligations.
These examples are not just regulatory stories. They are litigation signals. Opposing counsel can point to them and argue that sophisticated parties should understand the need to preserve messaging-app evidence.
“Deleted” does not always mean gone
From a forensic standpoint, deletion is not a single event with a single result. The answer depends on the device, app, operating system, backup history, cloud settings, retention configuration, and time elapsed.
A deleted message may exist in one or more places, including:
The sender’s device
The recipient’s device
iCloud or Google backups
Device-to-device transfer remnants
Notification previews
App databases
Attachments saved outside the chat thread
Linked devices, such as a desktop WhatsApp client or iPad
Cloud-synced media libraries
Enterprise archiving tools
Mobile device management systems
Screenshots or forwarded copies
Logs showing that communication occurred, even if content is unavailable
The opposite is also true. Some messages may not be recoverable, especially where auto-delete settings, app design, encryption, device wiping, backup overwrites, or normal database cleanup have eliminated recoverable artifacts.
That is why the forensic question should not be framed as “Can you recover deleted texts?” The better question is:
What communication artifacts should exist, where should they exist, what still exists now, and what does the absence of data indicate?
Preservation failures often happen before anyone calls the forensic expert
The highest-risk period is usually the gap between when litigation is reasonably anticipated and when devices are actually preserved.
During that window, several things can happen:
A custodian upgrades or replaces a phone.
A phone is backed up, restored, or wiped.
WhatsApp or Signal messages auto-delete.
A user deletes a thread.
A cloud backup is overwritten.
A company collects email but not mobile data.
A custodian continues using the same device, causing recoverable artifacts to be overwritten.
Counsel sends a legal hold but does not specifically address messaging apps or personal devices.
IT disables an account without preserving mobile-linked communications.
A departing employee keeps the device or returns it after data has changed.
By the time discovery disputes arise, the question is no longer just what happened. It becomes whether the preservation process was technically reasonable.
What counsel should do early
For litigation teams, the first step is not a full forensic collection. The first step is scoping.
Counsel should identify:
Which custodians used messaging apps for relevant communications.
Which apps were used.
Whether messages were sent from company devices, personal devices, or both.
Whether disappearing-message settings were enabled.
Whether the custodian used linked devices or desktop clients.
Whether backups exist.
Whether cloud sync was enabled.
Whether the device has been replaced, reset, damaged, or destroyed.
Whether relevant screenshots or exports were created.
Whether the opposing party has produced messages that should also exist on the client’s side.
That scoping exercise helps determine whether the matter requires targeted preservation, forensic imaging, logical acquisition, cloud collection, app-specific export, or a more limited preservation memo.
The forensic value is not limited to message content
Even where message content is missing, forensic analysis can still matter.
A proper review may identify:
Whether an app was installed or used
When an app was last accessed
Whether a thread existed
Whether attachments were downloaded
Whether media was saved locally
Whether a device was backed up or restored
Whether messages were deleted
Whether auto-delete settings may have been active
Whether screenshots were created
Whether a device was reset or migrated
Whether another device may contain the same data
This is especially important in disputes involving incomplete productions. A party may produce selected screenshots or partial exports, but those materials rarely answer the full provenance question. Screenshots need to be tied back to source data where possible. Exports need to be checked for completeness. Device and cloud artifacts may show whether the production is consistent with the underlying technical record.
Screenshots are not a substitute for preservation
Screenshots can be useful evidence, but they are not the same as a forensic collection.
A screenshot may show message content, but it usually does not prove the full context. It may not show the database record, sender/recipient identifiers, message IDs, edit history, deletion state, attachment metadata, device time settings, linked accounts, or surrounding messages. It may also omit whether the screenshot was cropped, edited, forwarded, or taken from another device.
In litigation, screenshots should be treated as leads. They may support an initial factual theory, but they should not be the endpoint if the original source device, account, backup, or app database can still be preserved.
Practical preservation checklist
When texts, WhatsApp messages, or other off-channel communications may matter, counsel should consider the following immediate steps:
Update the legal hold to specifically include texts, iMessage, WhatsApp, Signal, Telegram, Slack, Teams, Google Chat, and other relevant messaging platforms.
Instruct custodians not to delete messages, change auto-delete settings without guidance, reset devices, replace phones, or uninstall apps.
Identify personal devices used for business communications.
Preserve company phones before continued use overwrites artifacts.
Determine whether backups exist and stop automatic overwrite where appropriate.
Capture app-specific settings, including disappearing-message settings.
Identify linked devices, desktop clients, tablets, and cloud accounts.
Preserve relevant screenshots, exports, and attachments, but do not rely on them as the only evidence.
Document all preservation instructions and custodian responses.
Engage a forensic expert early enough to assess what can still be preserved.
The goal is not to collect everything from everyone. The goal is to make defensible decisions before relevant data disappears.
How Alethean helps
Alethean assists litigation teams with the technical side of mobile and off-channel message preservation. That includes targeted scoping, custodian questionnaires, mobile device preservation, cloud and backup analysis, deleted-message assessment, screenshot authentication, WhatsApp and messaging-app review, and expert support for discovery disputes.
In some matters, the work is proactive: helping counsel preserve the right data before production deadlines or motion practice. In others, the work is reactive: evaluating whether an opposing production is incomplete, whether messages should exist elsewhere, or whether deletion, auto-expiration, or device replacement affected the available evidence.
The key is timing. Deleted texts and off-channel messages can be recoverable, partially recoverable, corroborated, or permanently gone. The difference often depends on what happens in the first days after the issue is identified.
Off-channel communications are now central evidence. They should be preserved, collected, and analyzed that way.
Comments