Digital Evidence in Criminal Proceedings: Phone Examination, Lawfulness and Objection

Phone messages, screenshots and computer records may serve as evidence in criminal proceedings. However, the presence of a record in the file does not mean that it is sufficient for a conviction. The authority under which the record was accessed, the reliability of its content, its connection with the person concerned and the defence's opportunity to examine the record must each be assessed separately. Evidence obtained unlawfully cannot be the basis of a judgment; as to lawfully obtained records, it is separately examined whether they prove the elements of the offence.

This article addresses, from the standpoint of criminal procedure in Türkiye, the examination of a suspect's phone, the submission of WhatsApp correspondence, the review of forensic copies and expert reports, objection to seizure and the return of the device. The legal position is assessed as of 14 October 2026. Because of the date on which the Constitutional Court decision on CMK Article 134 takes effect, the date of the act is particularly important.

For which fact is a digital record being used to prove?

First, the type of the record and its relationship with the alleged event must be identified. A message extracted from a phone's memory, an operator's communications traffic record, a bank's transaction record and an image taken from social media do not show the same information. The methods of obtaining them may also differ. For example, logging into an account and the message constituting the offence having been written by a particular person are separate facts.

Lawfulness, technical reliability and probative force do not substitute for one another. Even where an examination order exists, the sender of a message may remain uncertain. Even if the content is genuine, it may have been obtained through an unlawful search. Even where the sender has been identified, the whole conversation may show whether a statement is a threat, a quotation or part of some other context. The court's reasoning for resolving these problems must be understandable.

Article 217 of the CMK is based on evidence presented and debated at the hearing and on the condition of lawful acquisition. Accordingly, the fact that a report comes from an official institution does not make unnecessary the examination of specific objections to the report. Likewise, because a record is digital, it cannot be treated as worthless in advance. [1]

What is the current position regarding CMK Article 134 and the Constitutional Court decision?

What did the annulment decision change?

In its decision E. 2023/128, K. 2026/36 of 12 February 2026, the Constitutional Court found certain parts of the first and second paragraphs of CMK Article 134 contrary to Articles 13 and 20 of the Constitution. The other provisions, which could no longer be applied, were also annulled, and as a result the whole article came within the scope of the annulment. [2]

The decisive reasoning of the majority is not that digital searches are prohibited in every case. The problem is that there are insufficient statutory safeguards concerning the retention, deletion and restriction of processing of personal data obtained after the proceedings become final, and the rights of the person concerned in this respect. The paragraphs 60–68 of the decision in particular explain this distinction.

In the dissent, it was argued that existing protection is sufficient, assessed together with archive regulations, the protection of evidence for extraordinary remedies and other procedural safeguards. This approach is not the ground for the annulment by the majority. When reporting the decision, it would be incorrect to derive an independent deletion period in force from the statements in the dissent.

When will the annulment provision take effect?

The decision was published in the Official Gazette of 25 May 2026, No. 33264, and the entry into force of the annulment provisions was postponed by nine months. Accordingly, the date is 25 February 2027. As of 14 October 2026, the annulment provision has not yet taken effect. [2]

For this reason, conclusions such as "CMK Article 134 can no longer be applied" or "all phone examinations are void" are not accurate. The lawfulness of an earlier act is assessed by reference to the provisions in force on the date of the act and to its concrete application. Nor does the annulment decision by itself lead to the quashing of all convictions or the immediate deletion of all copies.

A law adopted by way of a bill must be treated separately. Article 15 of the bill No. 2/3737, dated 22 June 2026, proposed provisions on the redrafting of CMK Article 134 and the retention of data. By contrast, the text of Law No. 7589, which is the enacted form of the bill, contains no amendment to CMK Article 134. The fifteen-year retention approach in the bill cannot be presented as the rule in force in CMK Article 134. [6–7]

Under what conditions may the police examine the content of a phone?

Seizing a device and examining its content are different acts

The seizure of a phone during apprehension or a search does not mean that all messages and application data may automatically be examined. The physical custody of the device and entry into its content must be assessed separately. The file must show which order authorised the act at the time the examination takes place.

For CMK Article 134, strong suspicion based on concrete evidence and the absence of any other means of obtaining the evidence are required. These conditions are not identical to the standard of reasonable suspicion in a general search. Instead of merely repeating statutory phrases in the order, the event and the connection that make the digital examination necessary must be explained. It is not essential that the device used by the suspect be owned by them; the relationship of use is examined. [1–2]

It is also important which device, account, event and scope of data the examination covers. An authority to examine in relation to a specific event cannot be applied as though it were unlimited authority to investigate a person's entire private life. Making a broad copy for technical necessity and examining and transferring every item of data in that copy to the file are not the same thing. Necessity and proportionality must also be observed at the implementation stage.

Time limits for the prosecutor's order and judicial approval

As a rule a judicial order is required. Where there is a risk of delay, the public prosecutor may decide. The prosecutor's order is submitted for judicial approval within 24 hours; the judge decides within 24 hours at the latest. If the period expires or the judge decides to the contrary, the copies made and the texts analysed are destroyed immediately. [1]

In this review, the date of the decision alone may not be sufficient: the start of the examination, the time of the prosecutor's order, and the times of submission for approval and of the judge's decision should be compared. The general seizure regime in Article 127 of the CMK and the special procedure under Article 134 must not be confused. An independent power of law enforcement to examine digital content cannot be derived from the power of a police supervisor under the general provisions.

Does handing over a phone with consent replace the order?

The suspect's handing over of a phone or consent to its examination does not replace the order and approval procedure under CMK Article 134. The decision of the 10th Criminal Chamber of the Court of Cassation (Yargıtay 10. Ceza Dairesi), dated 15 May 2024, E. 2023/15758, K. 2024/18787, is a concrete example on this point. [3]

In that decision, the WhatsApp records in the preliminary phone review record, made without the necessary decision or written order, were not accepted as lawful evidence. The Chamber also examined the remaining evidence and held it unlawful to enter a conviction instead of an acquittal, given the absence of an eyewitness-based finding about drug dealing and the nature of the other account. The judgment was quashed and a release subject to a specified condition was ordered.

The importance of the decision has two stages: first, an unlawful record cannot be the basis of the judgment; then it is assessed whether the other evidence proves the offence. The decision does not mean that an acquittal will be given without looking at other evidence in every case of a deficiency in phone examination. The complainant's submission of their own correspondence also constitutes a different situation, explained below.

How are forensic copies, backups and the return of a device assessed?

CMK Article 134(3) regulates the backup of all data in the system during seizure, and Article 134(4) regulates the handing of a copy of the backup to the suspect or their counsel and recording of the act in the record. In the current text, the handing over of this copy is not written as an act dependent solely on the person's request. The explanation that "no copy was given because it was not requested" should be assessed in that light. [1]

Handing over a copy should not consist only of delivering a file. It should be clear from which device, on which date and by which method the data delivered was obtained, and the copy's usability should be ensured. If an encrypted output or one that cannot be technically opened has been delivered, that problem must be clearly recorded in the record and in the application. Only then does the defence become able to carry out an independent examination.

Under the conditions in Article 134(2), such as the impossibility of decrypting a password, the inability to reach confidential data, or an act likely to take a long time, the device may be taken. Once decryption and the necessary copying are complete, the device must be returned without delay. However, if there is a claim that the device is also liable to forfeiture or is held on another legal ground, the basis of that is examined separately. A finding that a "copy was taken" does not by itself remove all grounds for seizure.

In a request for return, the identity of the device, the date of seizure, the state of examination and copying, the reason why retention is no longer needed, and any concrete effect on work or daily life may be explained. Objection to a refusal of a return request under CMK Article 131 is possible. Return of the device and deletion of data held by the authorities are not the same request; each must be justified separately. [1]

Can a message and screenshot submitted by a complainant be used?

Attaching to a criminal complaint a message the person received is not the same act as a search by the police of a suspect's phone. It cannot be said that a CMK Article 134 order is required in advance for every screenshot. Nevertheless, how the submitting person came to access the correspondence and what operations they performed on the record should be clarified.

Being a party to a correspondence does not give unlimited authority to use it. Submitting a record relating to an event to a judicial authority and publishing private conversations on the internet are assessed differently. Unauthorised access to another person's account, covert access to a device or systematic recording of conversations does not automatically become lawful on the ground that the purpose was to "gather evidence". Exceptional judicial assessments concerning sudden events should also not be treated as a general permission for all covert records.

The useful course for the person submitting a message is to preserve the original of the existing record, to keep what came before and after the conversation, to explain the relevant account and date information, and to ask that the original device or data be examined by the competent authorities. Cutting, rewriting or combining different conversations in a screenshot increases problems of verification. Irrelevant third-party information should not be widely circulated beyond what the judicial process requires.

Whether the record submitted by a private person actually exists, how it was obtained and its connection with the allegation are each examined separately. The defence too should not confine itself to saying "a screenshot is not evidence"; it should identify which part is missing or altered, or which access was unlawful.

What does a hash value and a technical report show?

A hash is not a proof of identity or accuracy

A hash is a numerical summary value calculated for a particular set of data. Comparing values obtained from the same data by the same method helps to test the integrity of two copies. However, one must first know which data was summarised, at what moment and with which algorithm. The value of a single file and the value of a whole disk copy cannot be compared directly. [8–9]

The hash value calculated today for a screenshot does not by itself show that the screenshot was not altered earlier. A comparison between the reliable record at the start of the examination and a copy used later serves a different function. Likewise, a hash match does not prove which person wrote the message or that the account in the message is correct.

Article 134 of the CMK contains no automatic consequence to the effect that "without a hash the evidence is invalid". The absence of a hash may be a significant problem of verification; however, legal assessment requires examination of the copying and storage procedures together with other means of verification. The existence of a hash also does not render valid an incomplete order or an unlawful access.

Not every phone examination produces the same kind of copy

File-based or logical data extraction and copying of storage at a broader level do not have the same scope. The device model, the operating system, encryption and the methods available may affect the data set that can be accessed. Instead of merely stating in a report that "an image was taken", the scope of the act and the areas that could not be accessed should be explained. The NIST guide on mobile device examination shows that the possibilities and limits of data extraction methods differ. That guide is not a Turkish procedural statute. [10]

Technical difficulty cannot be used as a general justification for waiving legal safeguards. On the other hand, the assumption that all data can be extracted from every modern phone by the same method and without any technical limitation is also not correct. The action taken, the necessary changes and the method of verification must be concretely explained in the report.

How are dates and application outputs checked?

The times at which a file was created, modified and exported may differ. The device clock and a server clock, or different time zones, are also not the same. For this reason, a date in a report should not be accepted as the precise time of an event without explaining from which record it was derived. The software version and the characteristics of the tool used to interpret the data may also affect the result. NIST IR 8354 emphasises that such technical limitations should be known to the investigator. [8]

From the expert, it may be requested that the tool and its version used, the source data examined, the filters applied, the missing records and the limits of the result be explained. If two reports reach different conclusions, not only the conclusion sentences but also whether they answer the same question on the same data should be compared. The task of the technical expert is to explain the data; the final assessment of the lawfulness of the record and whether the offence was committed belongs to the judicial authority. [1, Art. 67(3)]

How is the person who wrote a message separated from the WhatsApp account?

The fact that a telephone number or account is registered to a person does not by itself establish that the person wrote each message in dispute. Where there is a claim of a shared device, a linked session, access by another person or takeover of the account, its connection with the event and whether it can be investigated must be determined. A bare denial and a defence that identifies a particular date, mode of access and person are not of the same character.

The decision of the 9th Criminal Chamber of the Court of Cassation (Yargıtay 9. Ceza Dairesi), dated 10 February 2025, E. 2024/4261, K. 2025/929, shows the importance of this distinction. In the defence it was argued that a WhatsApp Web connection might have been established through brief access to the phone. The Chamber held that convicting without technical investigation into who sent the messages and through which access, and without assessing the defence, was unlawful under Article 230 of the CMK, and quashed the judgment. [4]

It does not follow from this decision that "WhatsApp messages are not evidence". The decision shows that a concrete alternative use claim must be investigated. Moreover, it cannot be assumed that IP, device or location information which the decision asks to be investigated will in every case be found retrospectively and in full. Whether the record was kept, the retention period, the means of obtaining it and technical limitations are separate matters.

In practice, date and time disputes, session information, the actual use of the device, records on the other side of the conversation and other lawful evidence may be assessed together. An IP address or account name does not in every case identify a human being on its own. The connection between the access data and the conduct alleged must be established in the reasoning.

Can digital data found in another file be transferred to this case?

A report coming from another investigation file does not remove the need to examine how it was obtained. The origin and manner of acquisition of the first device, the search and examination orders, any approval procedures, the scope of data examined and the basis for transferring the material to another file should be investigated. For evidence obtained by chance, CMK Article 138 is also assessed against its conditions of application. Data found during a search and a record encountered during the monitoring of communications are not treated under the same rules. [1]

In the decision of the Criminal General Assembly of the Court of Cassation (Yargıtay Ceza Genel Kurulu), dated 13 December 2023, E. 2022/515, K. 2023/661, correspondence on the phone of the deceased, examined in a homicide investigation, was used to support a different allegation. The Assembly considered it necessary to clarify whether the phone had been taken from the scene, handed over by relatives, or obtained through a search and seizure procedure, and to place the relevant orders on the file and discuss their lawfulness. The judgment was quashed because of incomplete investigation. [5]

The Assembly did not decide at this stage that all the messages were unlawful or that the accused should be acquitted. The effect of the decision in practice is that the documents of the first acquisition are also opened to review. The explanation "it was found in another file" is not in itself sufficient reasoning.

Where cloud accounts or records held by a foreign service provider are involved, the authority to access the data, the place where the data is held and the mutual legal assistance routes that may be used should also be assessed. Authority to examine a device cannot be inferred to give unlimited access to all remote accounts. Nor should it be assumed that the service provider holds the relevant record.

How can the defence obtain the copy and the expert report?

Article 153 of the CMK governs the defence counsel's review of the file and obtaining copies of documents. Although a restriction order may be made in an investigation on the conditions set out in the law, expert reports and the records of acts at which the suspect is entitled to be present remain separately protected under Article 153(3). The authority to review the file and the evidence held in custody after the indictment is accepted is regulated more broadly. [1] For further details, see file access and restriction orders in criminal investigations.

Access to a digital report that shows only the result page is not always enough to test a specific objection. A request for access should be framed to cover the copy on which the examination was based, the annexes to the report, the context of the records and the method used, stating which defence claim is to be investigated. Where third parties' private data are present, protective methods should be considered; but the defence must be enabled to test effectively the decisive record.

An objection to a report, a request for a new examination and the obtaining of a scientific opinion from a specialist are possible under Article 67 of the CMK. Under Article 68, a request may be made for an expert who prepared the report or a scientific opinion to be heard at the hearing. A request to hear an expert should state which technical conflict or method problem requires oral explanation. Not every objection to a report automatically results in the appointment of a new expert; the reasons for any refusal must also be reviewable. See also hearing of witnesses and experts in a criminal case.

Communications with lawyers and records containing professional secrets have separate special safeguards. Provisions such as the inability to review communications with defence counsel under Article 154 of the CMK, Article 130 on searches of law offices and Article 136 on the interception of communications should be taken into account according to the nature of the act. These safeguards should not be rendered invisible within an ordinary assessment of personal data.

Which documents and requests matter in an objection to digital evidence?

The application should not be limited to the statement "the evidence is unlawful". The record objected to should be identified, the problematic act shown and the legal outcome sought explained. If the documents have not yet been accessed, it may be requested that the relevant document be obtained, rather than asserting that an unknown act was definitely not performed.

Firstly, the search and examination orders, the prosecutor's order and judicial approval, the seizure and handover records, the backup and copy handover documents, the examination reports and their annexes should be read together. It should be investigated whether the device serial number or IMEI matches the device in the report; whether the dates and times are consistent; and by whom the copy is kept.

Depending on the concrete file, the following requests may come up:

• Documentation of the authority to examine and, if any, of judicial approval within the time limit.
• Rejection of a specific record obtained unlawfully and its exclusion from the basis of the judgment.
• Access to the missing parts of the conversation and to the data on which the report relies.
• For specific technical conflicts, an additional report, a new examination or the hearing of the expert.
• Investigation of a concrete alternative claim about use of the account.
• Return of a device that does not need to be retained and restriction of the unnecessary use of personal data.

The time limits for an objection to a seizure order and for an objection to the use of evidence are not the same matter. An application must be made within the statutory time limit against a judicial decision; objections to the use of the record in the trial should also be raised in a manner appropriate to the stage the file has reached. Failure to object to a measure does not in itself make an unlawful piece of evidence lawful.

The authority to which an application is made is determined according to whether the decision was made by a judgeship or by a court. The objection petition under CMK Article 268 is submitted to the authority that issued the decision; the power of review is determined under the provisions of the same article. Where judgment has been given, whether the route of appeal or cassation is open, the decision and the transitional provisions should be separately examined. Time limits in older decisions should not be carried directly to current applications. [1]

How is the case affected if an unlawful record is identified?

Under Article 38(6) of the Constitution and Articles 206(2)(a) and 217(2) of the CMK, evidence obtained unlawfully cannot be used to prove the offence. Article 230(1)(b) of the CMK requires that the evidence relied on in the judgment and the evidence rejected be discussed in the reasoning, and that the unlawful evidence in the file be identified separately. For this reason, merely stating "the objection was not found justified" may not be a sufficient explanation for an objection that is substantial and capable of affecting the outcome. [1–2] On this subject, the article Insufficiency of evidence and acquittal in a criminal case may also be a useful guide.

Excluding one record and acquitting in the whole case are not the same thing. If the remaining lawful evidence proves the elements of the offence, the assessment continues on that basis. If it is not established that the offence was committed by the accused, acquittal arises under Article 223(2)(e) of the CMK. Where the deficiency concerning the record is of a kind that can be clarified by investigation, a further examination may be needed at the appropriate stage.

Where a conviction rests on evidence obtained by an unlawful method, the absolute ground of unlawfulness in Article 289(1)(i) of the CMK becomes important. The absence of reasons in the judgment, or the restriction of the defence on important matters, is also separately assessed on its own terms. Which decision will be quashed or reversed depends on the route of appeal and the state of the file; a "digital evidence objection" is not a single application that produces the same result at every stage.

A claim for compensation arising from a search or seizure may also be raised separately. It cannot be said that every unlawfulness automatically leads to compensation without assessing the grounds in Article 141 of the CMK and the procedure in Article 142. The claims for the use of the evidence, return of the device, processing of personal data and redress of harm should be framed separately.

Conclusion

The value of a digital item in a file is not determined by the mere existence of an examination report or a screenshot. Authority and procedure, data integrity, attribution to a person, the context of the event and the possibility of the defence to check the material must be investigated together. For an objection to be effective, it must be specified which record and which act are defective, what effect this has on the allegation, and what examination or decision is requested.

The Constitutional Court decision on CMK Article 134 also raises the stages of retention and use after the data has been obtained. 25 February 2027 is an important threshold requiring an assessment according to the date of the act. Provisions of a bill that has not become law should not be applied as current law; subsequent legislation and transitional provisions must be followed separately.

Güneş & Güneş Law Firm, through the legal work it has carried on since 1999, provides information on criminal investigation and prosecution processes. Information on its area of practice is available from the criminal law services page. This article is general information; the decisions, records, dates of the act and time limits in a specific file must be examined together.

Related articles: Digital evidence in criminal proceedings: WhatsApp correspondence and screenshots; Objection to search and seizure and return of property; Objection to an expert report in a criminal case; Call detail and cell tower records.

Frequently Asked Questions

Can WhatsApp messages be evidence in a criminal case?

They can. The method of obtaining them, the integrity of the record, the connection with the sender and the context of the conversation are assessed together. Not every message is automatically evidence of guilt. For details, see the section WhatsApp account and the person who wrote the message.

If I hand over my phone of my own accord, can the police read all the messages?

The suspect's consent does not replace the order and approval procedure under CMK Article 134. The scope of the examination is also important. The Court of Cassation's relevant decision is discussed in the section on the conditions for a phone examination.

Does refusing to give my phone password show that I am guilty?

Not disclosing a password does not by itself prove the offence alleged. The safeguard that a person cannot be compelled to incriminate themselves, and the possibility of a technical examination under a lawful order, are separate matters. Difficulties in decrypting are dealt with in the section on forensic copies and the return of a device.

Is a screenshot alone sufficient?

The same answer cannot be given in every case. Where there is a concrete dispute about the accuracy and attribution of the record, the original data and other evidence may need to be examined. The distinctions in the section records submitted by a complainant are important.

If there is no hash value, must there be an acquittal?

No. The effect of the absence on the verification of data integrity, the other records and the methods of verification are examined. After an unlawful piece of evidence is excluded, the remaining evidence is also assessed. The section hash and technical report may be consulted.

Is it mandatory to give the defence a digital copy?

CMK Article 134(3)–(4) provides for backup during seizure and for a copy of the backup to be given to the suspect or their counsel. The nature of the act and of the copy is examined in the specific file. The forensic copy section and the file access section should be read together.

Is the time limit for objecting to an expert report always two weeks?

No. The period given under CMK Article 67(5) is the one that applies. It should not be confused with the general two-week time limit for objecting to a judicial decision under CMK Article 268. The table of applications and time limits shows this distinction.

Since CMK Article 134 has been annulled, can phones no longer be examined?

As of 14 October 2026, no such conclusion can be drawn. The annulment provisions take effect on 25 February 2027. The current position section explains the scope of the decision and the distinction with the bill.

If my device is returned, are the data in the file deleted too?

The return of a device and the retention or deletion of data are different acts. The return of the device does not mean that the copies in the file are destroyed automatically. The sections on the return of a device and on the Constitutional Court decision should be read together.

Can a phone record from another investigation be used in my case?

The original acquisition of the transferred record, the decisions, the scope of the examination and the legal basis for the transfer should be reviewed. Coming from another file is not in itself sufficient. The section on the Criminal General Assembly decision explains this problem.

Sources and legal bases

1. Criminal Procedure Code No. 5271 (Ceza Muhakemesi Kanunu), in particular Arts. 63, 67–68, 127, 130–138, 141–142, 153–154, 206, 217, 223, 230, 267–268 and 289. Text of the Ministry of Justice. Assessed for CMK Article 134 together with the Constitutional Court decision below and subsequent legislative documents. Constitutional bases: Arts. 13, 20, 36 and 38 of the Constitution.

2. Constitutional Court (AYM), 12 February 2026, E. 2023/128, K. 2026/36; Official Gazette of 25 May 2026, No. 33264; in particular §§ 45–73 and the operative part. Full text.

3. 10th Criminal Chamber of the Court of Cassation (Yargıtay 10. Ceza Dairesi), 15 May 2024, E. 2023/15758, K. 2024/18787; reasoning and decision. Full text.

4. 9th Criminal Chamber of the Court of Cassation (Yargıtay 9. Ceza Dairesi), 10 February 2025, E. 2024/4261, K. 2025/929; reasoning and decision. Full text.

5. Criminal General Assembly of the Court of Cassation (Yargıtay Ceza Genel Kurulu), 13 December 2023, E. 2022/515, K. 2023/661; Parts V/B and VI. Full text.

6. Law No. 7589 (7589 sayılı Kanun), accepted 16 July 2026; Official Gazette of 31 July 2026, No. 33326. Text as adopted by the Grand National Assembly of Türkiye (TBMM).

7. TBMM, bill No. 2/3737, dated 22 June 2026, Art. 15. Text of the bill. The proposal concerning CMK Article 134 is not present in the adopted text [6].

8. NIST IR 8354, Digital Investigation Techniques: A NIST Scientific Foundation Review, November 2022; technical limitations, time data and explanations of hash values. Report.

9. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, August 2006; data collection and integrity verification. Report.

10. NIST SP 800-101 Rev. 1, Guidelines on Mobile Device Forensics, May 2014; methods of extracting data from mobile devices. Report. NIST publications are technical reference sources; they have not been used as binding procedural provisions in Türkiye.

11. Lawyer Alican Çekmez, "The Lawfulness of Digital Evidence in Criminal Proceedings" ("Dijital Delillerin Ceza Yargılamasında Hukuka Uygunluğu"), Hukuki Haber, 13 October 2026. Article.

Source check date: 14 October 2026. Decision links may require provider access or membership.