When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (
com.android.providers.calendar) actually delete the event or does it just flag the event as deleted?
The reason I ask is because I was shocked to discover that one of the most popular Android calendar apps, Business Calendar 2, includes deleted events in export files. If you look at the export files, the deleted events are there in plain sight. Furthermore, if you import the files back into Business Calendar 2, the deleted events now appear as regular events.
This means that if you had an event entitled "Deliver confidential documents regarding project X-Ray to client Albatross" in your non-synced calendar, and you then delete the event, it is trivial for anyone with access to your device to restore that event in seconds. No forensics tools are needed.
It also happens to make the Business Calendar 2 export files practically useless, except as way to discover events the user had deleted.
Is this a flaw in Android (KitKat), a critical bug in Business Calendar 2, or a combination of the two?