A message seen on a phone screen can be an important starting point in a criminal file. However, placing a screen image in the file and proving an offense with that message are not the same stage. How the record was obtained, to whom it belongs, whether it was altered and in what context it was written should each be examined separately. If any of these questions remains unanswered, especially where a digital record is the decisive basis for a conviction, it becomes central to the defense. For details, see the article Phone examination, lawfulness and objection to digital evidence.
Short answer: WhatsApp messages and screenshots may be considered in criminal proceedings provided that they were lawfully obtained and that their reliability can be reviewed. A screenshot, a notarial ascertainment (noter tespiti) or a police record (kolluk tutanağı) alone does not resolve all questions of attribution, integrity and lawfulness. Assessing a conviction requires considering together the source, the method of acquisition, the technical examination and the defense's opportunity to object. [1]
What is digital evidence used to prove?
The existence, author and meaning of a record are different questions
The fact that a message is found on a particular device does not necessarily show that the owner of the device wrote it. The subscriber record of the line, the user information of the account, the person who actually used the device and the session in which the message was sent can all be separate. Claims such as a shared phone, linked devices, account takeover or a line registered in someone else's name are examined in light of the concrete circumstances of the file.
Even where attribution is established, the meaning of the message is assessed separately. A single word, without the preceding and following conversation, may not show an admission of guilt, a threat or an agreement. Irony, quotation, relaying someone else's words, and the date and context of events all matter. Conversely, saying that any message can easily be altered does not render all digital evidence worthless. The defense should identify the concrete problem in the specific record, and the examination should proceed on that basis.
The weight of the evidence in the file
A digital record may be a secondary element supporting other evidence, or it may be almost the sole basis for the accusation. The intensity of the need for examination depends on this position. A message corroborated by camera footage, a witness, bank transactions and physical findings cannot be subjected to the same reliability assessment as a single screenshot of uncertain origin.
CMK Article 217 provides that a judgment must rest on evidence presented at the hearing and discussed in the presence of the parties, and that the offense must be proven with lawfully obtained evidence. CMK Articles 206 and 230 are also important for the rejection of evidence and its assessment in the reasoning. A digital file, because it is technical, does not form a field independent of these procedural safeguards. [1]
Why does a screenshot alone not answer every question?
The difference between the displayed screen and the original record
A screenshot is an image of content displayed on screen at a particular moment. The original record of the message within the application, its sending information and the whole conversation are not the same thing. A name saved in the contacts shown in the image does not verify the legal identity of the other party. A cropped image, or one showing only part of the conversation, can change its meaning even if the content is genuine.
For this reason, the date, time, telephone number or account identifier, the beginning and continuation of the conversation, how the person presenting the record accessed it and, where possible, the original device are examined. Not every gap is proof of forgery, but it is not accurate to treat an image as conclusive evidence when a decisive gap has not been explained. The court should conduct research proportionate to the seriousness of the objection in the file.
What do a notarial ascertainment and a police record provide?
A notarial ascertainment can contribute to documenting the content displayed and the finding made at the time. However, it does not in every case resolve who actually wrote the past message, whether the record was altered before the ascertainment, or whether the content was accessed lawfully. The scope of a notarial act should not be treated as equivalent to technical verification.
A similar distinction applies to a police record. Its having been drawn up does not by itself make up for missing authority where the judicial order or prosecutor's order required for the measure is absent. If the content of the record conflicts with other records, hearing the persons who prepared it and examining the original data may become necessary.
Submitting one's own correspondence and searching the phone
The application of a party to the correspondence
The position of a person who submits a threatening or fraudulent message sent to them, for the purpose of a complaint, differs from that of someone who secretly enters another person's phone to obtain private conversations. However, being a party to a correspondence does not permit unlimited acquisition, dissemination or publication of all private content. The purpose of use, scope, relevance and the data of third parties are taken into account.
This distinction requires the file to state clearly through which route the digital record entered the case. Did the complainant submit a message from their own device? Is there an image sent by another person? Did law enforcement examine the entire device? No single answer such as "WhatsApp is evidence" can be given for different methods of acquisition.
Search and examination under CMK Article 134
CMK Article 134 regulates the measure of search, copying and analysis in computers and related records, subject to the conditions of strong grounds for suspicion based on concrete evidence and the absence of any other way of obtaining the evidence. In Court of Cassation practice, the examination of mobile phone content is also assessed within these safeguards. A judge's order is required or, in cases where delay poses a risk, a decision of the public prosecutor subject to the approval process set out in the law. [1][2]
It is provided that the prosecutor's decision be submitted for judicial approval within twenty-four hours, and that the judge decide within at most twenty-four hours. Where the legal conditions are not met, the consequences set out in the article for copies made and texts analyzed are assessed. When examining whether a search order exists, one should check not only whether it exists but also which device, person and transaction it covers.
Can consent replace the required judicial order?
In its decision of May 15, 2024, E.2023/15758, K.2024/18787, the 10th Criminal Chamber of the Court of Cassation (Yargıtay 10. Ceza Dairesi) held that taking WhatsApp records from a phone into a preliminary examination record, without the decision or written order required under CMK Article 134, was unlawful. The defendant's consent to the phone examination did not remedy this deficiency. The other evidence remaining in the file was also assessed, and the conviction was quashed. [2]
The limit of this decision is important. It concerns the examination by law enforcement of content on a suspect's phone. The decision cannot be read as a general prohibition that makes it unlawful in every case for a victim to add their own correspondence to a complaint. The assessment of applicability should examine whether the method of acquisition is of the same nature.
What does the 2026 annulment decision on CMK Article 134 mean today?
The annulment decision and its effective date are different
The Constitutional Court (AYM), by its decision of February 12, 2026, E.2023/128, K.2026/36, annulled CMK Article 134. The effective date of the annulment provisions was set at nine months after publication in the Official Gazette. The footnote in the current official statute text gives this date as February 25, 2027. As of the October 12, 2026 check of this article, the annulment has not yet taken effect. It is therefore not accurate to say that CMK Article 134 can no longer be applied in ongoing investigations. [1][7]
The decision's focus is on safeguards for the later use of data
The AYM assessed in particular the absence of statutory safeguards concerning the retention, deletion and restriction of processing of personal data obtained, the period and procedure, and the rights of the person, especially after proceedings have become final. The decision does not hold that computer and phone examination is prohibited in every case. It shows the need for safeguards that extend beyond the moment of interference, so §§ 60–68 and the operative part should be read together.
The decision also cannot be used as an acquittal that renders every past digital evidence invalid. The law in force on the date of the concrete procedural act, the alleged violation and the relevant remedy should be examined. For acts on or after February 25, 2027, it should be checked whether the new regulation or the transitional provision in force on that date applies. The effect of a legislative change on an earlier provision and the legal basis of a new technical examination are not the same question.
Preserving the record and technical verification
The original device, copies and process records
For a digital examination to be auditable, the identity of the device, the time of handover, from whom it was taken, the person who conducted the examination, the method used and the nature of the resulting files must be documented. CMK Article 134 contains provisions on backup and on giving a copy from the backup to the suspect or their counsel. These safeguards ensure that the defense is not left with only the result of the expert report.
It should not be assumed that a technical examination can be carried out to the same extent on every device and application. Locking, encryption, the application version, the operating system and the type of copy obtained may all affect the results. The report should explain not only the data that could be reached but also the areas that could not. The existence of an unexamined section is not proof that it contains data favorable or unfavorable to either side.
What does a hash value confirm?
A cryptographic hash value helps to compare whether a particular data set has changed later. However, the existence of the same hash value does not by itself prove that the data was correct when first created, or that the message was written by a particular person. The approach "a hash was taken, so the content cannot be disputed" therefore goes beyond the function of technical verification.
The NIST guide on mobile device forensics treats the preservation, acquisition, examination and reporting of data as separate stages. This technical source is not a regulation conferring authority under Turkish law. The legal authority derives from the CMK, while the openness and auditability of the technical method are discussed on the basis of examination standards and the expert assessment in the file. [4]
Date and time information
The time displayed in a message on screen may differ from the time shown in an exported record. The time zone, device settings, record format and the application's display method should all be investigated. A chronology of events built without knowing these differences can lead to erroneous inferences, such as that a person was elsewhere at the same time or knew about something before it happened.
If a time difference is alleged, the file should state how many hours it is, which set of records it was applied to, and what operation verified it. Shifting all records selectively, or correcting only the lines favorable to the defense, is not a scientific examination. The same method should be applied to all relevant data.
Which questions should be put to the expert?
Separating the legal assessment from the technical finding
An expert explains matters requiring specialized or technical knowledge. The final legal assessment, such as whether the defendant had intent or whether a conviction is required, belongs to the court. Where a report reaches a conclusion of "criminal-content correspondence" detached from the method used, it should be asked which message is attributed to the person and on the basis of which technical finding.
| Examination question | Expected explanation | Legal significance |
|---|---|---|
| From which source was the record obtained? | Device, application and file definitions | Review of the source and of the method of acquisition |
| Is the content complete? | Missing section, deletion or truncation | Proper establishment of the context |
| How was identity matched? | Number, account, session and user findings | Personalization of the attribution |
| Was a claim of alteration examined? | Method, comparison and limitations | Assessment of reliability |
| How was time interpreted? | Time zone and record format | Accuracy of the chronology of events |
| Can the result be re-examined? | Data used and explanations of the process | Effective objection by the defense |
Scientific opinion and supplementary report
A scientific opinion under CMK Article 67/6 may help to raise concrete technical objections. Its purpose is not to obtain a result contrary to the report in the file. A method error, a lack of data or an alternative explanation should be shown. Where necessary, the expert's explanation at the hearing, a supplementary report or a new examination is requested.
The defense's inability to access the data needed for examination is also an independent procedural problem. An access request should be submitted stating which file is needed, why, and which objection can be prepared only with that data. This topic should be considered together with the reviews of objection to an expert report and file access and restriction order.
Are covert audio recordings and message records subject to the same rule?
A narrow reading of case law on sudden events
The decision of the Criminal General Assembly of the Court of Cassation (Yargıtay Ceza Genel Kurulu) of May 21, 2013, E.2012/5.MD-1270, K.2013/248, is important for assessing conversation recordings used to prove an act directed at the person. The majority found the recordings lawful in the concrete case and upheld the conviction. The decision discussed criteria such as the sudden nature of the situation and the absence of other means of obtaining evidence or of recourse to the competent authorities. [3]
The decision also contains a dissenting opinion, which criticizes the lengthy recording of conversations and the absence of a judicial order. This distinction shows that stating the purpose of a recording does not by itself ensure lawfulness. Proof of long-term, planned and broad-scope monitoring should not be assessed on the same basis as an attack that occurs suddenly.
Legally protecting an existing record rather than creating one
This case law cannot be presented as a general instruction to make secret recordings. Accessing another person's account, obtaining a password, installing spyware or recording communications to which one is not a party may entail separate liability for offenses concerning private life and communication. Legal assistance is needed in preserving existing records without alteration and presenting them properly to the competent authorities.
The boundary between a person preserving a threatening message sent to them and someone collecting unrelated private correspondence of third parties must be maintained. When presenting material to the file, it is also important to avoid unnecessary disclosure of private data unrelated to the accusation. Confidentiality is considered not as a means of preventing the verification of evidence, but to ensure that the examination is carried out to the extent necessary.
How should an objection to digital evidence be structured?
Separate objection headings
The method of acquisition, technical reliability, attribution and interpretation of content are separate headings. For example, while arguing that a message does not belong to the defendant, it may alternatively be argued that the act of acquisition was itself unlawful. This is not a contradiction as long as the account of events remains consistent. The petition should clearly show the document on which each objection rests and the research requested.
A request that unlawfully obtained evidence not be relied on in the judgment and a request for a technical examination serve different purposes. A technical examination does not automatically remedy a lack of legal authority. Conversely, even where the act of acquisition was lawful, the attribution of the record to a person or the integrity of its content may still be disputed separately.
Assessment of the decisive defense in the reasoning
What can be expected from the court is not an answer of equal length to every detail. However, the reason why a concrete objection capable of changing the outcome was not accepted should be explained. Where a record showing that the phone was with someone else on the date of the event, a date contradiction in the image, or different versions of the same conversation are decisive, leaving them unassessed carries the matter forward to review on appeal.
It is important that the objection raised at the hearing be recorded in the minutes, that the expert opinion submitted be admitted to the file, and that requests for compulsory production be decided. At the stage of defense against the prosecutor's final opinion, all earlier objections to the digital record should be gathered together in connection with the outcome sought.
File analysis through two examples
A threat claim based on a single screenshot
In a hypothetical case, the complainant has submitted a single image of a message from a contact saved under the defendant's name. The defense should not limit itself to saying that the image could be altered. The identification of the number or account identifier, the messages before and after, whether the original device is available for examination, and other records confirming communication with the defendant should all be investigated. Whether the message carries the elements of the offense is also assessed in its context.
A conversation lawfully obtained but incompletely analyzed
In a second hypothetical, the necessary judicial orders exist, but the expert included in the report only a few lines supporting the accusation. The main objection here concerns the scope and interpretation of the examination rather than the search authority. The full conversation, the chronological sequence and the lines favorable to the defendant should be shown, and a further assessment requested. The fact that evidence was lawfully collected does not mean that every comment in the report is correct.
For related details, see call detail records and base station data, hearing of witnesses and experts, objection to a search and seizure order and false accusation offense. For details, see also the right to complain and the offense of false accusation.
Conclusion
The strength of digital evidence arises not from its technological appearance but from its lawful source, its verifiable integrity, its attribution to a person and its explanation in context. A screenshot, a phone examination and an expert report serve different functions. Effective defense keeps these functions distinct and ties the concrete objection to the examination required and to the legal result sought.
For legal support in criminal proceedings and enforcement processes, you may review our criminal law services.
Frequently Asked Questions
Is a WhatsApp screenshot alone sufficient for a conviction?
There is no automatic answer that applies to every file. The source, attribution, integrity and content of the image, and its relation to other evidence, are assessed. Relying only on the existence of the image without clarifying serious objections may cause problems.
Does voluntarily handing over a phone to law enforcement authorize review of all messages?
The examination under CMK Article 134 requires the safeguards of a necessary decision or written order. The Court of Cassation's decision of May 15, 2024 shows that the defendant's consent did not remedy this deficiency.
Does a notarial ascertainment make a message's authenticity definitive?
It contributes to the scope of documentation. However, it does not by itself resolve all the issues, such as who wrote the message, whether it was altered in the past, and whether the manner of acquisition was lawful.
Does an identical hash value prove that the defendant wrote the message?
No. A hash value helps to compare the integrity of the examined data set. On its own, it does not show that the content was accurate at the outset or that it was produced by a particular person.
Can all deleted messages be recovered?
No such guarantee can be given for every device and event. Technical access, backups, device and application features, the time elapsed and whether the data has been overwritten all affect the outcome. The report should state the limits of the examination.
If an unlawfully obtained record is later sent to an expert, does it become valid?
A technical examination does not by itself remedy the initial unlawfulness. The act of acquisition and the technical reliability of the data are separate legal assessments.
Sources and legal bases
1. Law No. 5271, Code of Criminal Procedure, particularly Articles 63, 67, 134, 206, 217, 230 and 289. Current text checked: October 12, 2026.
2. 10th Criminal Chamber of the Court of Cassation, May 15, 2024, E.2023/15758, K.2024/18787 — full text of the decision. Aygüneş Legal Information Bank (Aygüneş Hukuk Bilgi Bankası); the reasoning and operative parts of the decision were reviewed together.
3. Criminal General Assembly of the Court of Cassation, May 21, 2013, E.2012/5.MD-1270, K.2013/248. UYAP Legislation and Case Law Program; majority opinion and dissenting opinion.
4. Ayers, R.; Brothers, S.; Jansen, W., Guidelines on Mobile Device Forensics, NIST SP 800-101 Rev.1, 2014. Technical source on methods; not a binding procedural rule under Turkish law.
5. Constitution of the Republic of Türkiye, Articles 20, 22, 36 and 38/6.
6. Law No. 5237, Turkish Penal Code, particularly Articles 132–136 on the confidentiality of communications and the privacy of private life.
7. Constitutional Court (AYM), February 12, 2026, E.2023/128, K.2026/36, particularly §§ 60–68, 73 and the operative part. The effective date of the annulment was checked together with the footnote in the current official text of the CMK.