When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag the event as deleted?

The reason I ask is because I was shocked to discover that one of the most popular Android calendar apps, Business Calendar 2, includes deleted events in export files. If you look at the export files, the deleted events are there in plain sight. Furthermore, if you import the files back into Business Calendar 2, the deleted events now appear as regular events.

This means that if you had an event entitled "Deliver confidential documents regarding project X-Ray to client Albatross" in your non-synced calendar, and you then delete the event, it is trivial for anyone with access to your device to restore that event in seconds. No forensics tools are needed.

It also happens to make the Business Calendar 2 export files practically useless, except as way to discover events the user had deleted.

Is this a flaw in Android (KitKat), a critical bug in Business Calendar 2, or a combination of the two?

  • Keep in mind that even though the calendar app properly "deletes" the events they'll still be in the database file and probably on the flash memory as well. If you want true deletion then you may want to shred the calendar's database file and even then the disk's wear leveling algorithms may get in the way and relocate the "shredding" to different blocks than the blocks you actually wanted to overwrite. – André Borie May 27 '16 at 1:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.