My mom has an Android phone that fell in the water for a couple of seconds, around 16:30. She managed to disassemble the phone and turn it off. We both share a group that is end-to-end encrypted (all participants have new WhatsApp versions). The same day, around 21:00, while her phone was dead, I sent this group a message. In the next day, she took the phone to a repair shop and they changed some pieces and the phone was back to life. Once I got my hands on the phone, I noticed it had been factory reset, all apps gone, new Android version, no customisation, no files, no wi-fi password, totally blank. So I proceeded to reinstall WhatsApp for her, put her number in, expecting to see her old groups, but no messages. To my surprise, she received all the messages, including my own, that the group received while the phone was dead, before the factory reset.
I think I know how public-private keys work, and from what I understand the private key that is necessary for her to decrypt the messages sent to the group while the phone was dead was lost once the reset was made, since the messages stored at WhatsApp servers were encrypted with her old public key, with a now unmatched private one. So how could the app have received these messages?
A couple of theories that I have:
Her phone wasn't factory reset, or somehow the private key survived. I think this is unlikely since I had to install the app again and the phone had all signs to have been completed wiped out. It's important to notice that I don't know what the guys at the repair shop did to the phone, and she is unable to explain it to me.
My phone, upon seeing that her phone was back online, received her new public key and sent her again the message with new encryption. I don't have enabled that setting that warns about your contact's keys change, so I don't know if this could have occurred. For me it looks strange that my phone would promptly trust the new public key. But this theory gains strength since I noticed the messages are in the order from fastest devices to slowest. It's a group family, I have the fastest device, my sister has the middle and my dad has the slowest. The messages are in this order and never interchange.
The messages in question arrived as unread messages, with the timestamp when they arrived, not when they were sent. Because of this I cannot judge if the individual chats also received messages from the dead period. I can only judge from this particular group because I knew it was end-to-end encrypted from the start.
