Can Turkish police recover deleted WhatsApp messages during a criminal investigation? Learn how phone examinations, forensic copies, backups, screenshots and digital evidence are handled under Turkish criminal procedure.

Deleted WhatsApp messages can become important evidence in Turkish criminal investigations involving fraud, threats, harassment, blackmail, sexual offenses, financial crimes, company fraud and other allegations. A suspect may delete a conversation believing that it has disappeared permanently, while a complainant may claim that crucial messages were deliberately erased after an offense. The legal and technical reality is more complicated. Turkish police do not possess a universal method capable of restoring every deleted WhatsApp message. Whether deleted data can be recovered depends on the device, operating system, time elapsed since deletion, subsequent use of the phone, available backups, application configuration and the forensic condition of the device. Where a phone is lawfully obtained and examined during a criminal investigation, digital forensic specialists may search the device and available data sources for relevant evidence. Turkish criminal procedure places particular importance on lawful authorization and preservation of digital evidence, and Yargıtay has emphasized that digital data must be obtained and preserved through procedures capable of protecting its integrity.

Can Turkish Police Recover Deleted WhatsApp Messages?

Sometimes, but not always. There is no reliable rule that says Turkish police can recover every deleted WhatsApp conversation.

A message disappearing from the visible WhatsApp interface does not necessarily answer whether traces of that communication remain elsewhere. Depending on the technical circumstances, investigators may examine the device, available backups, stored files and other digital material.

Conversely, a message having once existed does not guarantee that its content remains technically recoverable.

Deleting a Message Is Different From Destroying Every Digital Trace

A user may press “Delete for me” and no longer see the message in the normal WhatsApp conversation. That does not necessarily establish that every relevant artifact associated with the communication has disappeared from every available source.

The recipient may still possess the message. A screenshot may exist. An exported conversation may have been created. A backup may contain relevant information. Media files may have been separately saved. Another linked device may contain relevant material. Notifications or other records may also provide contextual evidence depending on the particular device and circumstances.

For this reason, investigators should not treat “deleted from WhatsApp” and “no evidence exists” as synonymous concepts.

What Happens When Police Examine a Mobile Phone?

A smartphone is treated as a source of digital evidence, and examination is subject to criminal-procedure safeguards. Turkish Ministry of Justice materials concerning digital evidence discuss smartphones and other data-storage devices within the framework of digital searches and emphasize the importance of lawful collection and preservation. (Rayp Adalet)

Investigators may seek information relevant to the offense being investigated rather than simply looking at whatever happens to appear on the screen.

CMK Article 134 and Digital Examination

Digital searches, copying and seizure raise issues under Article 134 of the Turkish Criminal Procedure Code (CMK) and related procedural rules.

Current Ministry of Justice guidance explains that decisions concerning searches and copying of computer records are subject to specific authorization requirements and that prosecutorial decisions made in urgent circumstances must be submitted for judicial approval within the applicable statutory period. (Rayp Adalet)

This matters because recovering a deleted WhatsApp conversation is not merely a technical question. It is also a question of whether the device and data were obtained and examined lawfully.

Police Cannot Simply Ignore Digital-Evidence Procedure

A technically discoverable message does not automatically become lawful evidence if the underlying search or examination violated applicable procedural safeguards.

Yargıtay case law has stressed that digital evidence is vulnerable to manipulation and therefore must be collected and preserved in a manner that protects its integrity. (Rayp Adalet)

Forensic Copy of a Phone

One important concept in digital investigations is the creation of a forensic copy or image.

Instead of repeatedly working directly on original digital material, forensic procedures can be used to preserve data and conduct examination on an appropriate copy.

This can become important if the defense later alleges that files were changed after the device was seized.

Evidence Integrity

A central question may therefore be:

Was this data actually present when the phone was seized, or was it subsequently altered?

Documentation of the seizure and forensic process can become significant when answering that question.

Can “Delete for Everyone” Messages Be Recovered?

There is no universal answer. Whether any usable evidence remains after a message has been deleted for everyone depends on the technical circumstances and other available evidence.

The recipient may previously have taken a screenshot. The content may have been quoted or forwarded. Another participant may have preserved it. A relevant media attachment may exist separately. Backup data may also require examination depending on how the device and account were configured.

Therefore, “Delete for Everyone” should not be understood as a guaranteed method of eliminating evidence.

Can “Delete for Me” Messages Be Recovered?

Again, it depends on the circumstances. More importantly, deleting a message from one participant’s device does nothing to guarantee that the other participant no longer possesses it.

In many criminal investigations, the other person’s phone can therefore become just as important as the suspect’s device.

The Complainant’s Phone Can Be Critical

Suppose a suspect allegedly sends:

“Transfer the money tonight or I will hurt you.”

The suspect subsequently deletes the message.

If the complainant still possesses the original conversation, recovery from the suspect’s phone may not even be the central evidentiary issue.

Official prosecutorial guidance in Turkey specifically instructs investigators in telephone-message cases to identify the sending and receiving numbers, date and time, frequency and exact wording and, where messages remain on the complainant’s phone, to examine and record those messages. (OLTU ADLİYESİ)

Deleted WhatsApp Messages in Threat Cases

Threat investigations frequently involve selective deletion.

A complainant may present one threatening message while the suspect argues that earlier messages change its meaning.

For example, a screenshot may show:

“You will pay for this.”

But the complete conversation may have stated:

“If you refuse to repay the company money, you will pay for this through court proceedings.”

The complete context can materially affect legal characterization.

Deleted Messages Can Help the Defense Too

Digital recovery is not exclusively a prosecution tool.

A deleted conversation may contain material favorable to the suspect.

For example, it may demonstrate that the complainant initiated the confrontation, that an allegedly threatening expression referred to lawful proceedings or that the complainant’s screenshots omitted relevant context.

The prosecutor is responsible for investigating the material truth and collecting evidence both for and against the suspect. The Ministry of Justice reiterated this duty in its 2026 explanation of CMK Articles 160 and 161. (BASIN VE HALKLA İLİŞKİLER MÜŞAVİRLİĞİ)

Deleted WhatsApp Messages in Fraud Investigations

Fraud cases can involve much larger message histories.

Suppose a foreign investor transfers EUR 200,000 after receiving WhatsApp messages promising the purchase of property in Turkey. The sender subsequently deletes the conversation.

Investigators should not focus solely on recovering the deleted text.

The entire evidentiary chain may be reconstructed:

WhatsApp Communication → Payment Instructions → Bank Transfer → Recipient Account → Withdrawal/Transfer → Property Records → Subsequent Conduct.

Bank Records Can Corroborate Deleted Messages

Even if the precise message cannot be recovered, banking evidence may demonstrate that the victim transferred the exact amount at the exact time alleged.

Recipient Evidence

The victim’s device may contain the same conversation.

Screenshots

Screenshots sent to friends, lawyers or business partners before deletion may provide additional evidence.

Email Communications

The parties may have discussed the same transaction through email.

Other Messaging Applications

Telegram, Signal, SMS or social-media communications may provide related evidence.

Deleted Messages in Cryptocurrency Fraud

Cryptocurrency investigations often involve deleted messaging conversations.

The suspect may provide a wallet address through WhatsApp and later delete it.

If the victim preserved the wallet address or transaction record, investigators may reconstruct:

Message/Wallet Instruction → Exchange Purchase → Blockchain Transaction → Destination Wallet → Subsequent Transfers.

The disappearance of the WhatsApp message therefore does not necessarily eliminate the financial evidence.

Deleted WhatsApp Messages in Harassment Cases

Repeated unwanted messaging can become relevant to harassment or persistent-stalking allegations.

If some messages have been deleted, investigators may still examine the remaining communications, call history and other available evidence.

Frequency Can Matter

A criminal allegation based on repeated contact may depend not only on what was said but also on how often communication occurred.

Deleted Voice Messages

WhatsApp voice messages create another evidentiary category.

If a voice note remains available on another device or has been separately saved, its content may potentially become relevant even if it was removed from the original conversation.

Voice Identification

Where authorship is disputed, additional technical and circumstantial evidence may become important.

Deleted Photographs and Videos

Media sent through WhatsApp may sometimes have been saved outside the immediate conversation depending on device settings and user behavior.

Consequently, deleting the chat does not necessarily establish that every photograph or video associated with it has disappeared.

Gallery and Stored Files

A forensic examination may consider relevant stored data depending on the authorized scope of the investigation.

WhatsApp Backups

Backups can become important, but their availability should never be assumed.

Whether useful backup material exists depends on account settings, backup timing, device configuration and subsequent events.

A Backup May Predate the Deletion

If relevant data was included in an earlier backup, it may potentially provide another evidentiary source.

A Later Backup May Not Solve the Problem

If a new backup was created after deletion, the technical position may be different.

This is why forensic analysis must be case-specific.

Cloud Data and Criminal Investigations

Cloud-stored information creates separate procedural and technical questions from information physically stored on the seized device.

The fact that investigators possess a telephone does not automatically mean that they can freely access every cloud account associated with the user.

The lawful basis and scope of the investigative measure must be considered.

WhatsApp Uses End-to-End Encryption

WhatsApp communications use end-to-end encryption, which affects how communications are transmitted and accessed.

From a criminal-evidence perspective, however, encryption during transmission does not mean that messages visible or stored on an endpoint device are invisible to a lawful forensic examination.

The phone itself can therefore become an important evidentiary source.

Can Police Ask WhatsApp for Deleted Messages?

It should not be assumed that investigators can simply request a complete historical transcript of every deleted WhatsApp conversation from the service provider.

The practical investigation often focuses heavily on devices, backups, counterpart devices and corroborating evidence.

Foreign Numbers and Foreign Accounts

Investigations involving foreigners may include Turkish and international telephone numbers.

The prosecution may need to establish who actually controlled the relevant account at the time of communication.

Subscriber Identity Is Not Always Enough

The registered owner of a telephone number and the person actually using the WhatsApp account may differ.

Shared Corporate Phones

A business WhatsApp number may be accessible to several employees.

In that situation, identifying the registered company or subscriber does not necessarily establish which individual sent a particular message.

Linked Devices

WhatsApp accounts can be connected to additional devices.

This may become relevant where a suspect claims that another person had access.

Account Hacking Defense

A suspect may claim:

“Someone hacked my WhatsApp and sent those messages.”

Such a claim should be supported by concrete evidence where possible.

Security notifications, device history and evidence concerning account access may become relevant.

Lost or Stolen Telephone

If the alleged messages were sent after the phone was stolen, preserve objective evidence concerning the loss.

A police report, replacement SIM request or communications about the missing phone can help establish the timeline.

Phone Reset After the Alleged Offense

Factory resetting a phone can make recovery significantly more difficult depending on the technical circumstances.

It can also create evidentiary questions if the reset occurred after the suspect learned of the investigation.

A Reset Does Not Automatically Prove Guilt

There may be innocent reasons for replacing or resetting a device.

The prosecution should evaluate timing and surrounding circumstances rather than treating the reset itself as proof of the underlying offense.

Changing Phones

A suspect may legitimately replace a phone before learning about an investigation.

The old device may nevertheless become important if it still exists.

Do Not Dispose of the Old Phone

Where a person knows that relevant communications may become evidence, preservation can be important.

Uninstalling WhatsApp

Deleting the application and deleting individual conversations are technically different actions.

The evidentiary consequences depend on the particular device, backups and subsequent usage.

Reinstalling WhatsApp

Reinstallation may interact with backup restoration, but it should not be treated as a reliable forensic recovery method.

A criminal investigation should rely on appropriate technical examination rather than experimentation by the suspect or complainant.

Do Not Attempt Amateur Data Recovery Before Examination

Installing recovery applications can write new data to the device and potentially complicate forensic analysis.

If the messages are important evidence, preserving the device in its existing condition may be preferable.

Screenshots of Deleted Messages

A screenshot can remain even after the underlying message has been deleted.

The screenshot can therefore still be submitted as evidence.

But Screenshot Authenticity Can Be Challenged

The court may need to consider who created it, whether the original device is available and whether surrounding evidence corroborates the screenshot.

Cropped Screenshots

A cropped image may omit crucial context.

The defense should determine whether the complete conversation exists elsewhere.

Screen Recordings

A recording showing a person scrolling through a conversation may provide more context than a single screenshot, although it does not automatically resolve every authenticity issue.

Forwarded Messages

A message forwarded to another person before deletion may survive in that recipient’s conversation.

However, the fact that something was forwarded does not automatically establish who originally wrote it.

Group Chats

Deleted WhatsApp messages in group conversations create additional possibilities because several participants may possess relevant communications.

One Person’s Deletion Does Not Necessarily Affect Everyone

Other group participants may still possess evidence relevant to the investigation.

Witness Evidence

A witness who saw a message before deletion may provide evidence, although witness recollection and digital evidence are not identical.

Combine Witness Evidence With Digital Evidence

The strongest evidentiary picture often comes from corroboration.

Call Records and Deleted Messages

Telecommunication records may help demonstrate that communication occurred between particular numbers.

However, evidence showing that two persons communicated does not automatically establish the content of a deleted WhatsApp message.

Communication Evidence Is Not Content Evidence

This distinction is important.

Can Police Recover Messages Months Later?

Possibly, but there is no guaranteed time limit such as “30 days,” “six months” or “one year.”

Recoverability depends on technical circumstances rather than a universal statutory recovery period.

Can Messages Be Recovered Years Later?

In some cases, evidence may survive through another device, backup, screenshot or external record even when it is no longer recoverable directly from the original phone.

Direct forensic recovery becomes a separate technical question.

Android and iPhone Can Differ

The technical possibilities can vary according to operating system, device model, security architecture, application version and storage configuration.

Therefore, claims such as “Android messages are always recoverable” or “deleted iPhone messages can never be recovered” are unreliable.

Phone Encryption

Modern smartphones use sophisticated encryption and security systems.

This can materially affect forensic access.

Locked Devices

If investigators cannot access a device, different procedural and technical questions may arise.

Possession of a seized telephone does not necessarily mean that investigators can immediately extract every piece of information stored within it.

Scope of the Search

Another important defense issue concerns whether investigators remained within the legally authorized scope of examination.

A phone may contain years of private communications, photographs, financial information and professional records unrelated to the alleged offense.

Digital examination should therefore be considered in light of the authorization and applicable procedural safeguards.

Unlawful Phone Examination

Turkish case law has treated unauthorized examination of mobile-phone content as a serious evidentiary issue. Ministry of Justice materials cite Yargıtay authority concluding that evidence obtained from a phone examined without the required prosecutorial or judicial authorization could not form the basis of conviction. (Rayp Adalet)

Defense Should Examine How the Phone Was Obtained

Was it voluntarily provided?

Was it seized?

Was there an appropriate decision?

What did the decision authorize?

Who performed the examination?

Examine the Forensic Report

The report should be reviewed rather than relying solely on the prosecutor’s characterization of what was found.

Identify the Data Source

Was the alleged message recovered from the application database, a backup, screenshot, exported chat or another location?

This distinction can be important.

Identify the Relevant Dates

When was the message allegedly created?

When was it deleted?

When was the device seized?

When was the forensic examination conducted?

Chain of Custody

The defense may also examine who possessed the device between seizure and examination.

Digital Evidence Must Remain Reliable

Yargıtay has emphasized the need to preserve digital evidence intact and use procedures designed to prevent external interference. (Rayp Adalet)

Hash Values

Forensic processes may use cryptographic hash values to help demonstrate that a digital copy has not changed.

Why Hash Verification Matters

If the forensic image examined later produces the expected verification information, this can support data-integrity analysis.

Missing Forensic Safeguards

Where serious procedural or technical deficiencies exist, the defense may challenge the reliability or admissibility of the resulting evidence depending on the circumstances.

Deleted Messages Favorable to the Suspect

A particularly important problem arises where the prosecution recovers incriminating fragments but not surrounding exculpatory messages.

Context Should Be Investigated

The suspect can identify missing conversations and request appropriate examination where those communications are relevant to the defense.

Prosecutors Must Investigate Both Directions

The prosecutor’s role is not limited to collecting incriminating material. Turkish criminal procedure requires collection and preservation of evidence both for and against the suspect. (BASIN VE HALKLA İLİŞKİLER MÜŞAVİRLİĞİ)

Selective Digital Evidence

A forensic report containing only keyword hits can sometimes create an incomplete picture.

Read the Surrounding Conversation

A message should not necessarily be interpreted without its immediate context.

Example

Recovered fragment:

“I will make you pay.”

Complete context:

“If you don’t return the deposit, I will make you pay through enforcement proceedings.”

The difference may be legally significant.

Deleted Messages and Fraud Intent

In fraud investigations, communications before the payment can be especially important in determining whether fraudulent intent existed from the beginning.

Messages After Payment Matter Too

Repeated excuses, additional payment demands or contradictory explanations may also become relevant.

Deleted Messages and Money Laundering Cases

WhatsApp conversations may be used to investigate why money entered an account and what the account holder knew.

A deleted message such as “receive this payment and immediately forward it” can be important, but the prosecution should still establish authenticity, authorship and context.

Deleted Messages and Company Investigations

Foreign directors and employees may communicate through company WhatsApp accounts concerning payments and transactions.

Preserve Corporate Devices

If several employees used the same account, access rights and device history should be reconstructed.

Prepare an Access Matrix

Use:

User → Device → Account → Access Period → Linked Device → Relevant Message → Supporting Evidence.

What Should a Suspect Do Immediately?

Do not delete additional messages. Do not reset the phone. Do not install data-recovery software. Preserve relevant devices, backups and other communications.

What Should a Victim Do Immediately?

Preserve the original device and complete conversation. Take reasonable steps to preserve relevant material without modifying the underlying evidence unnecessarily.

Do Not Send Only Selected Screenshots

Where possible, preserve the entire relevant conversation.

Preserve Attachments

Voice notes, photographs, videos, documents and payment instructions may be important.

First 24 Hours

Preserve the phone in its existing condition, identify the relevant WhatsApp account and determine whether other devices contain the conversation.

First 48 Hours

Preserve screenshots, exports and available backups without unnecessarily modifying the original evidence. Identify other participants who may possess the communications.

First 72 Hours

Connect the messaging evidence with bank records, witnesses, CCTV, transaction documents or other evidence relevant to the alleged offense.

Prepare a Digital Evidence Timeline

Use:

Message Date → Sender → Recipient → Device → Deletion Date if Known → Backup Status → Device Seizure → Forensic Examination → Recovered Evidence.

Prepare a Recovery Matrix

Use:

Deleted Message → Suspect Device → Complainant Device → Backup → Linked Device → Screenshot → Forwarded Copy → Attachment → Other Corroboration.

Prepare a Procedural Matrix

Use:

Device → Person Possessing It → Seizure Basis → Examination Authorization → Forensic Copy → Examination Date → Relevant Finding → Defense Objection.

Common Mistakes

Do not assume deleted WhatsApp messages are permanently gone, do not assume police can recover everything, do not factory-reset a relevant device, do not install random recovery software, do not delete backups, do not rely solely on screenshots where original devices remain available, do not ignore the recipient’s device and do not overlook whether the forensic examination itself was lawfully authorized and properly documented.

2026 Criminal Defense and Evidence Strategy for Deleted WhatsApp Messages in Turkey

The correct approach is to treat deleted WhatsApp evidence as a combination of technical recoverability, evidentiary reliability and criminal-procedure legality. The first question is whether the alleged communication can still be established from any available source. The suspect’s phone should be considered together with the complainant’s phone, other participants’ devices, available backups, screenshots, forwarded communications, voice notes and related files. The second question is authorship: recovery of a message from an account does not always establish which person physically sent it, particularly where corporate accounts or linked devices were shared. The third question is context: isolated recovered fragments should be compared with the surrounding conversation. The fourth question is corroboration: fraud allegations should be compared with banking and asset movements, threats with the exact surrounding communication and harassment allegations with frequency and chronology. Finally, the legality and integrity of the forensic process must be examined. The practical roadmap is therefore: preserve the device → stop deleting data → identify the relevant account → identify all devices containing the conversation → preserve the recipient’s evidence → identify backups → preserve screenshots and voice notes → establish account control → reconstruct the communication timeline → examine deleted-message recovery → compare recovered fragments with complete context → connect messages with financial or physical evidence → review the seizure procedure → review the examination authorization → review the forensic report → identify the source of each recovered item → examine evidence integrity → challenge unlawful or technically unreliable evidence where justified → preserve favorable digital evidence → evaluate the complete criminal file rather than relying on isolated recovered messages.

Frequently Asked Questions

1. Can Turkish police recover deleted WhatsApp messages?

Sometimes. There is no guarantee that every deleted WhatsApp message can be recovered. The result depends on the device, deletion circumstances, backups, subsequent phone usage and other technical factors.

2. Does deleting a WhatsApp chat permanently destroy the evidence?

Not necessarily. The recipient may still possess the conversation, and screenshots, backups, forwarded messages or other evidence may exist.

3. Can police recover a message deleted “for everyone”?

There is no universal answer. Even if the message is no longer visible in the chat, other evidence of the communication may exist depending on the circumstances.

4. Can police examine my phone during a Turkish criminal investigation?

A mobile-phone examination is subject to Turkish criminal-procedure requirements. The legality and scope of the relevant search, seizure and digital examination should be evaluated in the particular case.

5. Can illegally obtained phone data be used against me?

The legality of obtaining digital evidence is an important criminal-procedure issue. Turkish case law has rejected reliance on mobile-phone evidence obtained through unlawful examination in relevant circumstances. (Rayp Adalet)

6. Can messages deleted months ago still be recovered?

Possibly, but there is no fixed recovery period. Technical circumstances and other available sources determine whether useful evidence remains.

7. Can police recover WhatsApp messages from the other person’s phone?

If the other participant still possesses the messages and the evidence is lawfully obtained, that device can become an important source. Official investigative guidance specifically contemplates examining a complainant’s phone when relevant messages remain stored there. (OLTU ADLİYESİ)

8. Should I reset my phone if I am under investigation?

No. Resetting or modifying a device can destroy potentially important evidence, including material that may support your defense.

9. What if recovered WhatsApp messages are taken out of context?

The surrounding conversation should be examined. A fragment can have a substantially different meaning when read together with the messages immediately before and after it.

10. Can deleted WhatsApp messages alone prove a crime?

There is no automatic rule. Recovered communications must be evaluated for authenticity, authorship, context, legality and evidentiary significance together with the rest of the case.

Legal Support for Deleted WhatsApp Evidence in Turkish Criminal Investigations

Deleted WhatsApp evidence can become important in Turkish investigations concerning fraud, threats, harassment, blackmail, financial crimes and company-related offenses. Cases may require analysis of mobile-phone examinations, forensic copies, deleted conversations, screenshots, backups, account ownership and the lawfulness of digital searches.

Fırat Fesih Kaya Law Office provides legal assistance to foreign nationals, foreign investors, company directors and international clients involved in Turkish criminal investigations concerning WhatsApp and other digital evidence.

Fırat Fesih Kaya can assist with deleted WhatsApp evidence, mobile-phone forensic examinations, disputed screenshots, unlawful digital searches, prosecutor statements, fraud investigations, threat and harassment allegations and criminal defense proceedings in Turkey.

Phone: +90 312 434 22 22
Mobile Phone: +90 532 769 22 22
Email: info@firatfesihkaya.av.tr
Address: Mevlana Boulevard No: 221, Yildirim Tower, Balgat, Cankaya / Ankara, Turkey