By Matik Kueth
Questions over erased communications and the reliability of digital recovery techniques took center stage in Juba on Friday, as a South African forensic expert told the special court that he was able to retrieve deleted messages from devices linked to suspended First Vice President Dr. Riek Machar and seven co-accused.
Testifying during the 66th session, prosecution witness Ratlhogo Peter Calvin Rafadi said advanced forensic tools allowed him to extract WhatsApp messages and other digital data that had been deleted, recalled, or hidden using disappearing-message functions.
He told the court that many of the communications under review were not accessible through normal phone use due to deletion or timed removal settings, but could still be recovered through forensic analysis.
Rafadi further stated that data extracted from the phone of Lt. Gen. Gabriel Duop Lam, one of the accused, included both recovered deleted content and messages that had remained intact on the device.
He also explained that he used specialized investigative software to retrieve encrypted and deleted WhatsApp material, which he later documented and presented in court through screenshots.
Rejecting allegations from the defense that the material had been manipulated, Rafadi insisted the integrity of the evidence remained intact.
“The extracted messages were not altered. I only extracted, analyzed and presented metadata that was submitted to the court,” he told the bench, adding that the tools used were certified and standard in forensic investigations.
The defense, however, raised concerns over the process and reliability of the extraction, questioning whether proper procedures were followed in handling the digital evidence.
Presiding Judge James Alala Deng adjourned the hearing to Monday, April 13th, 2026, for continuation of cross-examination as scrutiny of the electronic evidence intensifies.