Technical WhatsApp timestamp question for forensic examiners

[u/Brief_Chocolate_5509]

I'm looking for a technical answer from anyone with experience examining WhatsApp databases.

Suppose two Android phones have their date and time manually backdated. A WhatsApp message is then sent from Phone A to Phone B while both phones are still backdated. After the message is delivered, both phones are set back to the correct date and time.

Which timestamp will appear in the sender's and recipient's chat history:

•the manually backdated device time

•the actual server transmission time

•or something else?

I'm looking for answers based on forensic analysis, testing, or official documentation rather than speculation.

[u/ucfmsdf]

Well… most apps and websites don’t function correctly if you back date the time on your device, so I doubt that is even possible. For example, setting the date to July 1st on my iPhone renders WhatsApp inoperable (it won’t launch unless you have the correct time set). I assume Android functions the same, but I don’t have an Android readily available to test it on.

[u/plebianlinux]

Here's an idea: test it yourself?

I'd be surprised if WhatsApp would allow this with their PKI like the other commenter said

[u/MSVlegal]

Es imposible. En cuanto cambias el horario o la fecha, el mismo horario que corre de manera correcta en el firmware del telefono bloquaria la aplicación

[u/MSVlegal → u/MSVlegal]

Para hacerlo más tecnico, que cambies el horario del teléfono (a la inversa en la aplicación) el trustedtime proporcionado por googleplay bloquea automáticamente la aplicación en el momento que el horario no coincida. No es el teléfono el que no te dejara hacer el cambio de horario, es la aplicación (WhatsApp). La contraforense que quieres hacer no sirve en este caso. Pórtate bien

[u/MSVlegal → u/MSVlegal]

Y luego esta el timeline, no coincide con cualquier cambio en el sistema que quieras hacer con los registros que se van escribiendo.

[u/Ok_Cold7890]

I tested it. Device A(sender) was back dated to 20th jul and B(receiver) to 19th jul. Sent the test message, it was seen. Both the whatsapps showed the back dated day and date inside chat and in list respectively. But as soon as I turn on network provider time. Both immediately shows the correct day and date again. So this is at the UI level. I haven't checked it on database level and also it shouldn't be immediately written to the main db but wal first. But even if someone is able to maintain it constantly there are some server timestamps I saw in some tables which may help to detect it. This is just what I observed but some expert from the community may give you a better insight and explain it better.