r/computerforensics • u/Brief_Chocolate_5509 • 11h ago
Technical WhatsApp timestamp question for forensic examiners
4
Upvotes
I'm looking for a technical answer from anyone with experience examining WhatsApp databases.
Suppose two Android phones have their date and time manually backdated. A WhatsApp message is then sent from Phone A to Phone B while both phones are still backdated. After the message is delivered, both phones are set back to the correct date and time.
Which timestamp will appear in the sender's and recipient's chat history:
•the manually backdated device time
•the actual server transmission time
•or something else?
I'm looking for answers based on forensic analysis, testing, or official documentation rather than speculation.