Evidence Basics · 9 min read
Five Things a Chat Export Leaves Out (And What Breaks Because of It)
Notes from building parsers for WhatsApp, Android SMS, iMessage, and email exports: the fields consumer exports do not carry, and the review problems each gap creates.
The short answer
A chat export is a rendering of a conversation, not the conversation. Five things are commonly missing, and each one changes what the file can support. Consumer exports rarely carry a stable per-message identifier, so any tool that needs to reference a specific message has to derive one. Timestamps are usually present but not guaranteed for every line, and some WhatsApp text exports produce messages with no parseable timestamp at all. Sender fields hold display labels chosen by the account holder or the phone’s address book, which is not the same as verified identity. Media is frequently exported separately or not at all, which silently changes what a reply appears to be responding to. Edits and deletions generally leave no trace, so the export shows a final state rather than a history. None of this makes an export unreliable; it makes the gaps worth writing down instead of discovering them later.
1. A stable message ID
Databases inside a messaging app assign every message a row identifier. That identifier is almost never included in the file a user can export. A WhatsApp .txt export is a sequence of lines. An Android SMS CSV has address, body, date, and a direction flag. An iMessage CSV has a handle, a body, and a timestamp. None of them ship a durable ID that survives re-export. The practical consequence is that message identity has to be reconstructed from content. Textimony derives a stable identifier by hashing the conversation, the timestamp, the sender, and the normalized message text together — the same four inputs always produce the same identifier, so a re-import of the same file lands on the same references rather than creating duplicates. That approach is deterministic and reproducible, and it has a real limit worth stating plainly: two genuinely distinct messages with the same sender, same second, and identical text are indistinguishable from a duplicate. That is rare in practice and common enough in bulk or automated messages to be worth checking rather than assuming.
2. A guaranteed timestamp on every message
Most people assume a timestamp is the one field always present. It usually is. It is not always. WhatsApp text exports put a date and time at the start of each message line, but multi-line messages, some forwarded blocks, and certain locale formats produce lines a parser can attribute to a sender without recovering a time. Our WhatsApp parser records these explicitly rather than guessing: the message is kept, the timestamp confidence is set to zero, and the record is flagged as having no message timestamp from the source. Guessing would be worse than the gap. A message placed at an invented time sits in the wrong position on a timeline, and a timeline is exactly the artifact people build to argue about sequence. A message with a recorded gap can be handled honestly. A message with a fabricated time cannot be distinguished from a real one later.
3. Verified sender identity
Export files carry sender labels, not identities. An Android SMS export carries the phone number in an address field plus a flag for whether the message was outgoing. An iMessage export carries a handle, which may be a phone number or an Apple ID email, and often a contact name pulled from the address book of whoever performed the export. A contact name is a label the exporting user controls. It can be a nickname, an ex-partner’s first name, or the wrong person entirely if a number was reassigned. Direction flags are more reliable than names because they come from the platform rather than the address book, which is why participant mapping should start there and treat display names as a claim to be checked. Where a sender genuinely cannot be attributed, the honest handling is to count it rather than to fill it in. Textimony tracks the proportion of messages with an unresolved sender and stops a run when that proportion is high enough that participant mapping needs human review, instead of proceeding with a confident-looking result built on an assumption.
4. The media the conversation was about
Several platforms ask whether to export with or without media, and the smaller option is the one most people pick because it produces a file they can actually email. Others deliver media in a separate folder with filenames that do not obviously map back to the message that referenced them. This is the gap that most often changes meaning. A reply reading “this is what I meant” is close to content-free without the image above it. A one-word answer to a photo can look dismissive or reasonable depending on what was sent. Message counts, response-time measurements, and tone impressions all shift when the attachments are missing and nothing marks their absence. The workable habit is to record the export option chosen at the moment of export, when it is still known, and to note where the media folder lives relative to the text file. Reconstructing that decision months later usually is not possible.
5. Any trace of edits and deletions
Most consumer exports render the current state of a thread. A message edited three times exports as the final version. A message deleted for everyone typically exports as nothing at all, or as a placeholder that does not say what the original said. This means an export cannot, on its own, establish that a conversation is complete. It is evidence of what the account showed at the time of export, which is a narrower claim than it first appears and a more defensible one. Where a deleted message matters, the older copy is a separate source: an earlier export, a screenshot taken before the deletion, a notification preserved on another device, or the other participant’s copy. Preserve those as their own artifacts with their own provenance rather than merging them into the export and presenting the result as one continuous record.
Why write the gaps down
Every gap above is survivable. What is not survivable is discovering one at the point where the record is being questioned, because by then the gap looks like something that was concealed rather than something that was inherent to the format. The reviewable version of a message record is the one that states its own limits: which export produced it, what that export format does and does not carry, how many messages lacked a timestamp or a resolved sender, and where media lives. That is a smaller claim than “here is the complete conversation,” and it is one that holds up. Record the platform, the export option chosen, and the date of export while they are still known. Keep the delivered file unmodified and work from a copy. Note the count of messages with no timestamp or no resolved sender rather than quietly dropping them. Keep media alongside the text export and note the relationship between them. Treat screenshots and earlier exports as separate sources with their own provenance.
Do chat exports include a message ID?
Usually not. The internal row identifier the app uses stays inside the app. Tools that need to cite a specific message derive an identifier from the message content instead — Textimony hashes the conversation, timestamp, sender, and normalized text so the same message always resolves to the same reference across re-imports.
Can a text message export be missing timestamps?
Yes, though it is uncommon. WhatsApp text exports can produce lines that a parser attributes to a sender without recovering a time, particularly with multi-line or forwarded content. The honest handling is to keep the message and record that the source supplied no timestamp, rather than estimating one and placing it on a timeline as though it were known.
Does the contact name in an export prove who sent a message?
No. Contact names come from the address book of whoever performed the export and can be changed at any time. Platform direction flags — whether a message was sent or received by that account — are more reliable than names. Establishing who was physically holding a device is a separate question that a file cannot answer.
Does exporting without media matter?
It can matter a great deal. Replies that refer to a photo, voice note, or document lose most of their meaning when the attachment is absent, and nothing in the text file marks what is missing. Record which option was used at the time of export; that choice is difficult to reconstruct afterwards.
Will an export show messages that were deleted or edited?
Generally no. Exports render the current state of the thread, so an edited message appears in its final form and a deleted message usually appears as nothing or as a placeholder. An export therefore evidences what the account displayed when it was exported, which is a narrower and more defensible claim than completeness.
Published by
Textimony. Editorial status: Source-linked informational guide. Updated: 2026-07-26.
Sources
WhatsApp Help Center: Export chat history; Apple Support: Archive or make copies of iCloud information; Federal Rule of Evidence 901: Authenticating Evidence; NIST IR 8387: Digital Evidence Preservation