Do Not Delete Evidence From Your Phone

Why should you keep everything on your phone?

If your bank account is frozen or you are being investigated over a mule account, every message, screenshot and transaction record on your phone can become evidence. You may want to delete things that look bad. That is one of the worst mistakes you can make.

Under Section 114(g) of the Evidence Act 1950, the court can assume that evidence you destroyed would have hurt your case. ^[f1] So deleting a message that could have proved your innocence works against you.

For the wider picture on building your evidence file, see our evidence preparation pillar.

What happens if you delete evidence?

Deleting evidence weakens your defence. It can also lead to a new criminal charge.

The court assumes the worst (s114(g)). If the court sees that evidence existed and you destroyed it, it can conclude the evidence would have hurt you. ^[f1] This applies even if the deleted messages would have helped you. The court never sees them, so it assumes the worst.

A separate charge (s201). Section 201 of the Penal Code makes it an offence to make evidence disappear, with up to 3 years in prison and a fine where the original offence carries 10 years or more, such as Section 424C or money laundering, and less for lesser offences. ^[f2] This is separate from any mule account charge or money laundering case. Prosecutors can add it if they believe you tampered with evidence.

You lose credibility. Even without a separate charge, an investigator who finds deleted messages may doubt everything else you give them. The rest of your evidence counts for less when it looks like you picked what to delete.

What can police forensic tools recover?

Deleted messages are not always gone for good. Police forensic units use special software that can pull deleted data from phones. ^[f4]

Deleted WhatsApp messages can stay in database files on your phone. Even after you clear a chat, pieces of it can remain in temporary and backup files. Forensic tools read these files directly, without going through the app.

Banking app data, such as login times, viewed transactions and saved account details, can survive after you delete the app. The phone’s system logs keep traces of app activity. Call records, SMS and location data can also stay in parts of the memory that normal deletion does not reach.

Cloud backups are another source. WhatsApp backups on Google Drive or iCloud hold your message history, and investigators can request them from the provider. Deleting the copy on your phone does not delete the backup.

What must you keep?

Keep everything. These items matter most.

All messaging apps. WhatsApp, Telegram, WeChat and any other app you used to talk to the person linked to your account problem. This includes group chats, media files, voice messages and call logs.

Banking and payment apps. Do not uninstall or clear data from your banking apps, e-wallets (Touch ‘n Go, GrabPay, Boost) or any payment app. Your transaction history shows the pattern of activity on your account.

Emails. Keep emails from your bank about the freeze, transaction alerts, and anything from the person involved. Check your spam and trash folders and move anything relevant to a safe folder.

Phone records. Keep call logs and SMS, especially with anyone linked to the investigation. Do not clear your call history.

How do investigators find out you deleted something?

Investigators have several ways to spot deleted evidence. That is why deleting is both useless and risky.

When police seize your phone and run a forensic extraction, the software can flag recently deleted items. It may show when each item was deleted, which can make it clear if you removed it after the investigation began.

Comparing your phone with other evidence exposes gaps. If the other person’s phone shows a chat with you and yours does not, the deletion shows. Bank records may also point to transfers that match missing messages.

Your phone also records when apps were uninstalled, when many messages were deleted at once, and when storage was cleared. Investigators trained in digital evidence know where to look.

What if you have already deleted something?

Stop deleting now. The harm from past deletion may be limited, but carrying on makes it worse.

Write down what you remember about the deleted content: rough dates, the people involved and what the chats were about. A note made now helps your lawyer judge the damage and plan a response.

Tell your lawyer honestly what you deleted. What you tell your lawyer when seeking advice is generally protected, and your lawyer needs the full picture to defend you. Hiding it from your own lawyer can cause costly surprises later.

Look for backups: WhatsApp messages may still be in a Google Drive or iCloud backup. Deleted emails may still be in the trash folder. Your bank keeps its own transaction records whatever is on your phone.

If you are not sure what to keep, or you have already deleted something, a lawyer can tell you what to preserve and how to explain any gaps to investigators.

A step-by-step checklist for keeping your evidence

Start these steps as soon as you learn about a freeze or investigation.

Step 1: Stop deleting. Do not delete messages, apps, photos or files. Do not clear your browser history. Do not factory reset your phone.

Step 2: Turn on cloud backups. Switch on automatic backups for WhatsApp and other messaging apps. This keeps a second copy in case your phone is seized or damaged.

Step 3: Screenshot key chats. Take screenshots of important messages using the method in our screenshot preservation guide. Include timestamps, contact names and the full thread.

Step 4: Export your chats. WhatsApp and Telegram let you export a full chat history. Use this to make files you can store away from your phone.

Step 5: Download bank statements. Log in to online banking and download PDF statements for at least 12 months. Save them to cloud storage and a USB drive. The evidence preparation guide explains which periods matter most.

Step 6: Lock your phone. Set a strong passcode and do not lend your phone to anyone. If you are called to give a police statement, ask your lawyer about your phone before you go.

How do courts treat electronic evidence?

Section 90A of the Evidence Act 1950 sets out how Malaysian courts treat electronic documents. ^[f3] Chat messages, transaction logs and screenshots can be used as evidence once it is shown they are genuine and unchanged.

The court needs to be sure a document has not been altered. Original files on your phone, with their hidden date and time details intact, are stronger than screenshots alone. That is why keeping the originals matters.

Your lawyer can ask the service provider for a certificate confirming the records are intact. For bank records, the bank provides this. For messaging apps, an exported chat file is harder to challenge than separate screenshots.

Sources

1. Evidence Act 1950, Section 114(g), adverse inference for withheld evidence
2. Evidence Act 1950, Section 90A, admissibility of electronic documents
3. Penal Code, Section 201, causing disappearance of evidence
4. Low & Partners, “Keldai Accounts: When Helping a Friend Becomes a Criminal Offence” (2024)
5. Criminal Procedure Code, provisions on seizure and examination of evidence