A South African digital forensic expert told the special court in Juba on Friday that he recovered deleted messages from devices belonging to the accused in the case involving suspended First Vice President Dr. Riek Machar and seven others.
Testifying during the 66th session, prosecution witness Ratlhogo Peter Calvin Rafadi said he used forensic tools and techniques to retrieve data that he said had been deleted from the devices of the seven defendants.
“Most of these messages were physically deleted or recalled using a default timer or send-off function, which made manual viewing difficult,” Rafadi told the court.
He said he was able to obtain additional evidence from the phone of Lt. Gen. Gabriel Duop Lam, the fourth accused, noting that some WhatsApp messages had not been deleted.
He also said he used investigative digital tools to extract deleted WhatsApp messages and other encrypted materials, and that he later took screenshots to support the extracted data. Rafadi rejected claims by the defense that screenshots of messages attributed to Duop Lam had been altered.
“The extracted messages were not altered. I only extracted, analyzed and presented metadata that was submitted to the court,” he said.
Rafadi added that his device, which he described as certified by South Africa’s Private Security Industry Regulatory Authority, was used to conduct the analysis. He also disputed suggestions that he failed to properly document the extraction process.
Presiding Judge James Alala Deng adjourned the hearing to Monday, April 13, 2026, for continuation of cross-examination.
Machar, 73, who has been suspended as first vice president, and his co-accused face charges including murder, conspiracy, terrorism, treason, destruction of public property and crimes against humanity. He remains under house arrest, while the others are detained by the National Security Service in Juba.
Prosecutors allege that forces linked to the Sudan People’s Liberation Army in Opposition, allied with the White Army militia, killed 257 soldiers from the South Sudan People’s Defense Forces, including commander David Majur Dak, and destroyed or seized military equipment worth about $58 million in an attack on the Nasir garrison in March 2025.
and then