Introduction

A company thinks that one of their workers shared secret client information on WhatsApp before they quit their job. This old worker says that they deleted the chat and there is no way to prove anything. The people looking into this take the workers phone and give it to a person who looks at phones to see what is really going on. Everyone wants to know one thing: when you delete a message on WhatsApp is it really gone for good or is it still, on the phone?

This type of thing happens a lot in workplace investigations fraud cases and even when the police are looking into something. WhatsApp is a popular messaging app that people use all the time and the conversations people have, on it can be very important when something bad happens. It is helpful to know how WhatsApp works when it comes to keeping and getting rid of messages because this helps us understand why we can sometimes get back messages that were deleted and why we sometimes cannot get them back. WhatsApp is used by people and WhatsApp messages can be used as evidence so it is good to know how WhatsApp stores WhatsApp messages and deletes WhatsApp messages.

This article explains how WhatsApp stores data on Android phones and iPhones. It looks at what happens when you delete a message. The article also talks about the methods forensic experts use to find any leftover traces. It is meant for people who're new to this topic so you do not need to know anything, about forensic science.

How WhatsApp Stores Messages

Each and every WhatsApp text message that you transmit or obtain is made accessible in the phone's local database file immediately before it appears on your phone's screen. You can visualize the database as an electronic notebook in which every new event is written as a new entry, with the application simply using this notebook to read the history of conversations.

Android: msgstore.db

In Android, WhatsApp saves chat history in ,msgstore.db. This file is an SQLite database, which is a compact format for maintaining data. WhatsApp takes daily encrypted backup versions of the chat messages and gives them a name corresponding to the date (for example, msgstore-YYYY-MM-DD.1.db.crypt15).

iOS: ChatStorage.sqlite

The alternative file on the iPhone is referred to as ChatStorage.sqlite. It is similar in function to msgstore.db that is found on android devices. It keeps all messages, contacts, and media info in formatted SQLite within the application's private storage section.

SQLite Databases and WAL Files

SQLite consists of more than one SQL file, and it usually works with an additional known as Write-Ahead Log (WAL). Instead of recording every change into the main database file, SQLite sends new or modified data to the WAL file, and it then gets into the main database.

For forensic purposes, the WAL file is important because it can temporarily hold copies of data, including messages, that have already been removed from the main database view.

Local Encrypted Backups

Both the operating systems Android and iOS also back up chat data at regular intervals, either saved in the device itself or stored on services like iCloud or Google Drive. While backups are usually securities, it is important to note that these backups are an independent snapshot, as it was created in the past.

Android msgstore.db (SQLite) + daily .crypt15 backup iPhone ChatStorage.sqlite + iCloud / local backup SQLite Main DB SQLite Main DB WAL File Both platforms follow the same core pattern: a SQLite database, a WAL buffer, and periodic backups
Figure 1: WhatsApp storage architecture on Android and iOS

What Really Happens When a Message is Deleted

WhatsApp gives users three different ways to remove a message, and each one behaves differently at the storage level.

Delete for Me

When you choose this option it just hides the message from you. The other person will still see the message. It will still be on their phone. On your phone the message is marked as deleted. The message is still somewhere on your phone. The message is not really gone it is just hidden from your view. This option only affects how you see the message it does not affect the participant. The message record is marked as removed on your phone but the actual message is still on your phone it is just not visible, to you.

Delete for Everyone

So when you delete a message, on WhatsApp it tries to remove that message from every persons phone who got it. Then it puts a note that says "This message was deleted" where the message used to be.. This does not mean the message is really gone for sure. If someones phone was not connected to the internet or they already read the message or they have a copy of their messages saved somewhere then the message is still there. WhatsApp just asks the phones to delete the message it does not actually make sure it gets deleted.

Clear Chat / Delete Chat

When you clear a chat it gets rid of the messages in that conversation.. When you delete a chat the whole conversation is gone from the list. Either way the messages are still, on the computer somewhere. Clearing a chat and deleting a chat do not make the messages disappear from the storage chip away. The messages are still there even though you can not see them when you clear a chat or delete a chat.

The Bookshelf Analogy: Freelist Pages and Overwriting

Imagine a library with books on shelves. When a book is deleted it isn't thrown away. The librarian just marks the shelf as free, for a book and takes the books card out of the catalogue. The book stays on the shelf until another book is put there.

This is very similar to how SQLite works internally. When a record is deleted, SQLite usually marks that storage page as part of a freelist, meaning the space is available to be reused. The old data is not immediately wiped; it simply becomes invisible to the app until the space is overwritten by new data.

User Taps Delete Message selected DB Record Removed from index Hidden from chat UI Page → Freelist Marked reusable Overwritten (eventually) Delete for Me Delete for Everyone Clear / Delete Chat All three actions hide the message before the underlying data is ever overwritten
Figure 2: Message deletion workflow across the three delete options

Why Deleted Messages Can Sometimes Be Recovered

Because of how SQLite and mobile storage work, a deleted message often leaves several traces behind. Here are the main reasons recovery can succeed.

SQLite Freelist Pages

As previously stated, deleted data could reside in unutilized freelist pages. Forensic tools are able to scan these pages and sometimes reconstruct the original message, the sender, and the time it was sent.

WAL Files

If the WAL file has not yet been merged (checkpointed) with the main database, it may still have a complete set of recently deleted or altered messages, including those that are not present in the main database anymore.

Backups

Scheduled intervals are used to take the local and cloud backups instead of continuous ones. A deleted message might still be available in the backup file, even though it is removed from the chat live system since the most recent backup was taken.

Unallocated Storage

In the bigger phone memory (not only the SQLite database), old files can remain in free space, which is an area that the OS deems as "free" but hasn't reallocated yet. By using special procedures, it is possible to get access to these files.

Overwriting Reduces the Chances

The more the phone is used after a deletion, the more likely that freed storage space gets overwritten by new photos, app data, or messages, permanently destroying the old content. Time and continued phone usage are the biggest enemies of successful recovery.

Simple example: Imagine erasing a sentence written in pencil, then quickly wiping the eraser dust away. The words might not be visible anymore, but a faint impression can still be seen on the paper if you look closely enough, at least until someone writes firmly over the same spot with a pen. Freelist and WAL data behave in a similar way.

Android vs iPhone: Recovery Potential

While both platforms follow the same general storage principles, some practical differences affect how forensic examiners approach each one.

Factor Android iPhone
Storage File msgstore.db (SQLite) ChatStorage.sqlite
Recovery Potential Often higher, more accessible file system Generally more restricted due to iOS sandboxing
Backups Local .crypt15 files, Google Drive backup iCloud backup, local iTunes/Finder backup
Security Varies by device manufacturer and encryption setup Strong default encryption and sandboxing
Limitations Root access often needed for deep extraction Jailbreak or advanced tools often required
Android Open file system Root access unlocks more Manufacturer-dependent security iPhone Sandboxed file system Jailbreak often required Strong default encryption vs
Figure 3: High-level comparison of recovery conditions on Android and iPhone

Common Digital Forensic Recovery Techniques

Forensic examiners rely on a combination of methods, chosen based on the device, its security state, and the goals of the investigation.

  • SQLite Database Analysis: Directly parsing msgstore.db or ChatStorage.sqlite, including freelist pages, to reconstruct message history.
  • WAL Analysis: Examining the Write-Ahead Log file for recent changes not yet merged into the main database.
  • Backup Analysis: Decrypting and examining local backup files to recover an earlier snapshot of chats.
  • Cloud Backup Analysis: Retrieving and examining backups stored on Google Drive or iCloud, where legally authorized.
  • Logical Extraction: Pulling accessible app data and files through standard device interfaces, without deep low-level access.
  • Physical Extraction: Creating a raw, bit-by-bit copy of the device's storage, which can expose unallocated space.
  • Chip-Off / ISP (In-System Programming): Advanced hardware-level techniques used in specialized labs when other methods fail, typically reserved for serious cases.

Forensic suites such as Cellebrite UFED, Magnet AXIOM, Oxygen Forensic Detective, and open-source tools like Autopsy are commonly used to automate parts of this process. These are mentioned here only as real-world examples; the focus of this article is on the underlying storage concepts rather than any specific product.

Seize Device Acquire Image Parse SQLite / WAL Reconstruct Chats Report
Figure 4: Simplified forensic investigation workflow

Common Myths About Deleted WhatsApp Messages

Myth: "Delete for Everyone" permanently removes all evidence.
Reality: It only requests removal from recipients' devices. Copies may still exist in backups, notifications, or on devices that were offline at the time.
Myth: Every deleted message can always be recovered.
Reality: Recovery depends heavily on timing, device usage, encryption, and whether the freed storage space has already been overwritten.
Myth: A factory reset guarantees all data is gone.
Reality: A factory reset removes the visible file system, but depending on the device and encryption method, remnants can occasionally still be recovered using advanced techniques, though this is far from guaranteed.
Myth: End-to-end encryption prevents forensic investigation entirely.
Reality: End-to-end encryption protects messages while in transit between devices. Once a message is decrypted and stored locally on the phone, it exists in plain, readable form inside the local database.
Myth: Deleted chats immediately disappear from storage.
Reality: As explained earlier, deleted records typically move to freelist pages first and are only truly gone once that storage space is overwritten.

Challenges and Limitations

Recovery is never guaranteed. Several factors can make it difficult or completely impossible:

  • Overwritten Database Pages: Once freelist space is reused, the original content is gone for good.
  • Strong Encryption: Modern encryption standards on both the app and device level can block access without the correct keys or credentials.
  • No Available Backups: If backups were disabled or deleted, there may be no earlier snapshot to fall back on.
  • Factory Reset: Significantly reduces recoverable data, especially on modern encrypted devices.
  • Unsupported or Newer Devices: Forensic tools do not always keep pace with the latest device models and OS versions.
  • Secure Deletion Features: Some devices and apps actively overwrite freed space to prevent recovery, by design.

Legal and Ethical Considerations

Digital forensic work involving someone's private messages is a serious undertaking, and it must always be carried out responsibly.

  • Obtain Proper Legal Authorization: Investigators should have a valid warrant, consent, or organizational authority before examining a device.
  • Respect Privacy Laws: Data protection regulations vary by country and must be followed carefully throughout the process.
  • Maintain Evidence Integrity: A clear chain of custody and documented process is essential so that findings can hold up to scrutiny.
  • Follow Forensic Best Practices: Recognized standards, such as those referenced by NIST, help ensure findings are reliable and repeatable.

Conclusion

Deleting a WhatsApp message on your phone rarely means the data disappears instantly. Between freelist pages, WAL files, local backups, and unallocated storage, several traces can remain behind for some period of time. Whether those traces are actually recoverable depends on a mix of technical factors: how the device was used afterward, whether encryption keys are available, and how much time has passed since deletion.

For anyone involved in digital investigations, understanding these mechanics helps set realistic expectations. Deleted does not always mean destroyed, but it also does not mean automatically recoverable. Every case depends on its own specific technical circumstances.