When one deletes a Whatsapp (or other similar apps) message from a device (assume that no Google Drive, ICloud backup), can this message be recovered from the device? Does Whatsapp save messages into SQLite DB as normal text/unencrypted format?
-
"Does Whatsapp save messages into SQLite DB as normal text/unencrypted format?" is easily searched online. We've even talked about it on this site. I took that entire line and popped it into a Google query and got technical details.– schroeder ♦Commented Oct 26, 2019 at 19:41
-
As for "whatsapp deleted messages", that, too, is easily searched. As this is more of a question about this one product, and isn't even a forensic concern, and both questions can be answered by the top hits on Google, I'm closing as not a security question.– schroeder ♦Commented Oct 26, 2019 at 19:45
Add a comment
|
2 Answers
Yes, it is possible, but like with many security questions it depends on the circumstances.
Generally the messages can't be recovered because WhatsApp state that they do not store chat histories on their servers.
If the message has been backed up using either iCloud Backup (for iOS devices) or Google Drive (for Android devices) then the message can be recovered when the user uninstalls WhatsApp and restores the backup.
To restore using the Google Drive method the user would need to restore to a local backup from the local WhatsApp database. This can be found in the WhatsApp > Database folder on the device. The filename is msgstore.db.crypt12 and there shoudl be various msgstore-YYYY-MM-DD.1.db.crypt12 files.
If the device is Android then it may also be possible to recover the message using a data recovery program such as Android Photo Recovery which utilises USB debugging mode to scan the device from a PC or a Mac.
Additionally to Mike Pooles answer, be aware that you sent this message to at least one other device.
If you don't have control over the other end device, it will be always possible to recover your message by acquiring the device or its backups.
Hiding the fact that you communicated with this party is difficult or even impossible because the metadata is available on the servers of Facebook, on the other end device and possible other third parties.
-
-
That is not necessarily accurate. Many secure messaging platforms have the ability to delete the message from the remote side too, when deleted locally. Obviously this discludes screenshots being taken as a way to retain the message contents.– Jesse P.Commented Oct 27, 2019 at 1:08
-
@JesseP. But there's no guarantee that this feature works on the target device at all. Additionally, this doesn't work on backups as long as they are not deleted or overwritten with the new state. When the backup is on a server, it's also very likely that there are backups of the backup and so on. In the end, it strongly depends on the threat actor but in general this kind of feature should not be relied upon for highly sensitive information.– NoirCommented Oct 27, 2019 at 15:24
-
@Noir No guarantee that it will succeed but some give a response of whether it did or not, so at least users know what the result was. Still, it's possible and an option none-the-less.– Jesse P.Commented Oct 27, 2019 at 17:45