Are deleted text messages admissible in BC court?

Yes. Deleted text messages recovered through a defensible forensic process are admissible in BC courts when authenticated under section 31.1 of the Canada Evidence Act. The strength of the admissibility depends on the recovery method, the chain of custody, and the qualifications of the examiner who recovered the messages. Screenshots of messages are weaker than forensic acquisition because they do not preserve the underlying database metadata that supports authentication.

This article walks through what counsel needs to know about deleted-text-message admissibility in BC, the framework for authentication, and the practical steps to maximize the evidence's weight.

Table of contents

1. The Canadian framework for electronic evidence
2. How deleted text messages survive on the device
3. The authentication question
4. Screenshots versus forensic acquisition
5. Common challenges from opposing counsel
6. Practical steps for counsel
7. FAQ

1. The Canadian framework for electronic evidence

The admissibility of electronic evidence in Canadian courts is governed by section 31.1 to 31.8 of the Canada Evidence Act for federal proceedings, with parallel provisions in the BC Evidence Act for BC matters.

The proponent of the evidence must establish the integrity of the electronic system in or by which the evidence was recorded or stored. This is typically done through evidence about the system's reliability, evidence about the chain of custody, and (for forensic recoveries) evidence about the methodology used.

For deleted text messages specifically, the authentication question turns on the recovery process: was the device acquired through a defensible forensic method, was the chain of custody documented, and is the recovery methodology reproducible by another examiner?

2. How deleted text messages survive on the device

Modern phones store text messages in a SQLite database. iMessage on iOS uses sms.db. Android uses various per-app databases (mmssms.db on stock Android, plus per-OEM variants).

When a user deletes a message, the message is typically marked as deleted in the database but the underlying row content often survives in:

• The SQLite write-ahead log (WAL). A transaction log used for performance that often retains content for an extended period.
• The journal file. A separate transaction log that retains content until the next checkpoint.
• Unallocated database pages. Pages that have been freed by SQLite but not yet overwritten.
• iCloud or Google backups. Server-side backups that often preserve content past local deletion.
• Paired-device backups. iTunes and Android backup files that preserve content at the time of backup.

A full file system extraction recovers the most. Logical extraction recovers less. Cloud-backup analysis recovers what was synced before deletion.

3. The authentication question

For Canadian counsel, the authentication question is what determines admissibility. The court needs to be satisfied that the recovered messages are what the proponent claims they are: actual messages sent or received on the device at the times indicated, by the parties indicated, with the content indicated.

Authentication is typically supported by:

• The forensic examiner's affidavit describing the acquisition, the recovery method, and the integrity of the underlying database.
• Hash verification of the forensic image, supporting the integrity argument.
• Chain of custody documentation from the moment of contact through analysis.
• Methodology disclosure that allows opposing counsel to reproduce the recovery independently if they wish.

Where these elements are present, courts have generally accepted recovered messages. Where they are missing, the evidence is more vulnerable to challenge.

4. Screenshots versus forensic acquisition

Screenshots are common but weak. A screenshot of a message thread:

• Does not preserve the underlying database row, including the timestamp, sender ID, and other metadata.
• Can be edited or fabricated without leaving visible trace.
• Cannot be authenticated against a server-side record (unless the message is also recovered from the carrier or a cloud backup).
• Does not preserve deleted content that was not visible at the moment of the screenshot.

Forensic acquisition of the source device is the more defensible path. The acquisition preserves the underlying database, including the metadata that supports authentication and the deleted content that screenshots miss.

For matters where forensic acquisition is not possible (the device is in the opposing party's hands and not yet under court order), screenshots may be the only available evidence. Counsel should preserve them with metadata and seek forensic acquisition through discovery as soon as practical.

5. Common challenges from opposing counsel

Three common challenges to recovered text-message evidence:

1. Methodology challenge. Opposing counsel argues the recovery method is unreliable or has not been described in sufficient detail. Defensible methodology disclosure addresses this.

2. Chain of custody challenge. Opposing counsel argues the chain has gaps that introduce reasonable doubt about the integrity of the recovered data. A clean chain-of-custody record addresses this.

3. Fabrication challenge. Opposing counsel argues the recovered messages were planted or modified. Hash verification of the forensic image, paired with methodology disclosure that allows independent verification, addresses this.

The strongest position for the proponent is to anticipate each challenge and address it in the examiner's affidavit, with the methodology and chain-of-custody documentation attached as exhibits.

6. Practical steps for counsel

When you anticipate that text messages will be central to your matter:

• Preserve the device early. Do not let the user continue using the phone if it can be avoided. Continued use risks overwriting deleted content.
• Engage forensic acquisition. Screenshots are a placeholder, not a substitute.
• Insist on a full file system extraction. Logical extraction recovers less.
• Preserve cloud backups. iCloud and Google backups often retain content past local deletion.
• Document chain of custody from intake. This is usually the easiest target for opposing challenges.
• Get the examiner's affidavit drafted alongside the report. Sworn evidence carries more weight than an unsworn report.

Reference: Canada Evidence Act, sections 31.1 to 31.8. For BC matters, see also BC Evidence Act.

7. FAQ

Q: Can deleted iMessages be recovered from an iPhone? A: Often yes, depending on iOS version, device model, and how recently the deletion occurred. A full file system extraction recovers the most.

Q: Can deleted WhatsApp messages be recovered? A: Often yes. WhatsApp uses a SQLite database with WAL behaviour similar to iMessage. Local backups and iCloud or Google Drive backups often preserve content well past local deletion.

Q: Can deleted Snapchat messages be recovered? A: Less often than iMessage or WhatsApp. Snapchat is engineered to delete content quickly. Cached media, database fragments, and notification artifacts can survive on the device.

Q: What is the difference between authentication and admissibility? A: Authentication is the threshold step of establishing that the evidence is what its proponent claims. Admissibility is the broader question of whether the evidence is admissible at trial, which includes authentication plus relevance, hearsay considerations, and other rules.

Q: Do we need an expert witness to introduce the evidence? A: Usually yes, where the recovery involved forensic methodology that the trier of fact cannot evaluate without expert assistance. The expert witness duty under White Burgess applies.

Related posts

• How to preserve mobile phone evidence: a checklist
• Chain of custody for digital evidence in Canada
• Cryptocurrency tracing in matrimonial cases

CTA strip

Headline: Have a matter that turns on text messages? Primary CTA: Book a confidential consultation Secondary text: Or call (604) 800-9060