Kirchner Assassination Attempt Investigation: Experts Analyze Deleted Phone Data

According to the expert's statement, no report had been filed describing the condition of the phone or who had it in custody. The absence of these records fueled doubts within the judicial investigation, which is now trying to reconstruct exactly what happened to the device during that critical period. In the forensic analysis conducted by the Gendarmerie, specialists managed to recover WhatsApp conversations from June 2, 2022, onwards. The temporal coincidence with the period when the cell phone was not under judicial custody reinforces the need to establish who had access to the device during those hours. To advance this reconstruction, specialists are analyzing the impact of telephone antennas and signal records to determine the precise location of the device and its possible movement. During the hearing, the expert also explained that to delete WhatsApp messages, the phone must be on. The Federal Oral Court No. 6 sentenced Fernando Sabag Montiel to 10 years in prison as the material author of the attempted assassination of Cristina Fernández de Kirchner, and to Brenda Uliarte to eight years in prison as a necessary participant in the attack. However, doubts about what happened to the attacker's phone in the first hours after the attack remain open and could lead to new judicial measures to clarify if there were irregularities in the preservation of one of the most relevant digital evidence in the case. In applications installed on phones, if the device is off, it does not receive notifications or record messages at the time they were sent. The investigation is now trying to determine if the deletion was done manually, with the cell phone in someone's hands, or executed remotely from another device. Meanwhile, the main judicial case already had a criminal definition in 2025. He also noted that without physically accessing the phone, it is difficult to determine if the messages were deleted from the device itself or through some remote mechanism. Another relevant element of the expertise was the reconstruction of the device's activity on wireless networks. A statement by an expert from the Argentine National Gendarmerie once again put the handling of digital evidence under scrutiny in the investigation for the 'attempted murder' of then Vice President Cristina Fernández de Kirchner, which occurred on September 1, 2022, in front of her home in the Recoleta neighborhood. According to the testimony given to Justice, the accused's mobile phone remained on and active for several hours after his arrest, during which WhatsApp messages were deleted. The specialist testified as a witness in the case that is being handled by Federal Judge María Eugenia Capuchetti, with the intervention of the Federal Prosecutor's Office No. 2, and ratified the conclusions of previous expertise by the Gendarmerie. During that interval, there would have been no technical procedure for preserving the device or detailed documentation that recorded its physical and digital state. It was not until 00:23 on September 2, 2022, at the intersection of Juncal and Uruguay streets, that the official chain of custody form was completed. For example, when referring to a message received at 22:25 on the day of the attack, he stated that this event necessarily implies that the device was operational. The expert also detailed that the functioning of mobile applications differs from that of email systems. According to his analysis, the accused's mobile device registered activity after the attack, when the accused was already under police custody. The testimony also provided a sensitive piece of information for the case: during that period, the content of several messages corresponding to September 1 and part of September 2, 2022, disappeared, i.e., hours after the attack on then Vice President. This fact reinforces one of the hypotheses that the Justice is investigating: the possible deletion of data from the attacker's phone at a time when the device had not yet been formally incorporated into the judicial chain of custody. According to the expertise's reconstruction, approximately three hours and twenty minutes passed between the time of the attack and the formal seizure of the phone. The report identified two connections of the phone to the Abasto Shopping's WiFi network on the same day of the attack: one at 19:32 and another at 22:38. The exact location of the device at the time of that second connection is now one of the central points of the investigation. However, the events corresponding to the day of the attack and part of the following early morning present a particularity: the system preserves traces of the interactions, but the content of the messages was deleted. The expert explained that the deletion mainly affected private conversations, not group chats, which suggests a selective deletion of the material. Consulted during the hearing, the specialist indicated that this deletion could have occurred after the attack. Buenos Aires, March 8, 2026 - Total News Agency - TNA -.