Can Police Recover Deleted Text Messages?

28 Oct Can Police Recover Deleted Text Messages?

Posted at 14:03h in Phone and Digital Evidence by

The short answer

Sometimes. Whether police can recover deleted text messages depends on four things: the phone, the messaging app, the type of extraction they ran, and how much time and use passed after the messages were deleted. Some deleted messages come back easily. Others are gone for good, and no tool on earth will bring them back.

The question I get most often comes from two directions. Defense lawyers ask whether the prosecution’s “recovered deleted messages” are real. People in criminal cases and divorces ask whether what they deleted can be found. The honest answer to both starts in the same place.

Why "deleted" doesn't always mean gone

On a modern phone, there’s a big difference between deleting a file and deleting a message.

Files (photos, videos, documents) are stored on encrypted flash storage. On current iPhones and Android phones, each file has its own encryption key, and deleting the file destroys the key. The phone’s storage also clears out freed space in the background. Once a file is truly deleted from the device, recovering it from the phone itself is practically impossible.

Messages are different. Most messaging apps don’t store each message as a file. They store messages as rows inside a database, usually an SQLite database. When you delete a message, the app often doesn’t erase it on the spot. It marks that space in the database as free to reuse. Until something overwrites it, the old message can sit there in pieces: in the database’s freelist pages, in its write-ahead log (WAL), or in unused space inside the file.

That’s why forensic tools can sometimes recover deleted messages from a phone that won’t give up a single deleted photo.

Where deleted messages survive

  1. The Recently Deleted folder. Since iOS 16, the iPhone’s Messages app keeps deleted texts in a Recently Deleted folder for 30 days (Apple says permanent deletion can take up to 40). Any extraction made during that window may capture them as if they’d never been deleted. Many people don’t know the folder exists.
  2. Leftovers inside the app’s database. As described above, deleted rows can survive in freelists, WAL files and unused space until the database cleans itself up. How long that lasts varies by app, by operating system and by how heavily the phone is used. In one published test, a forensic vendor recovered most deleted WhatsApp messages from an Android phone through the database’s write-ahead log, but found no recoverable deleted records in WhatsApp on an iPhone.
  3. The other person’s phone. You can delete a conversation from your phone. You can’t delete it from the phone of the person you were talking to. In practice, this is where “deleted” messages turn up most often.
  4. Backups and cloud copies. An iCloud backup or Google backup made before the deletion can still hold the message. So can a computer the phone was backed up to, or a tablet or laptop signed into the same account. Whether police can read a cloud copy depends on the service and the account’s encryption settings, but the copy often exists.
  5. Notification records. On some devices and versions, the operating system logs incoming notifications, and those logs can include message previews long after the message itself was deleted.
  6. Carrier records, mostly without the words. Phone companies keep records of who texted whom and when, often for years. They generally don’t keep the content. A Justice Department chart prepared for law enforcement in 2010 showed most major US carriers keeping no text content at all, with Verizon keeping it for 3 to 5 days. Retention policies change, but the pattern is the same: carriers can prove a message was sent, not what it said. Apps like iMessage and WhatsApp don’t go through the carrier’s texting system at all.

Where deleted messages are usually gone for good

  • After the Recently Deleted window, once the database has been cleaned up. When the app or system compacts its database, freed space gets overwritten and the leftovers disappear.
  • Deleted attachments. Photos and videos sent in a chat are usually stored as separate files, so they behave like any other deleted file on an encrypted phone: once they’re gone, they’re gone.
  • On a phone that’s been reset or replaced. A factory reset destroys the encryption keys for everything on the device.
  • After weeks or months of heavy use. Every new message, app update and photo gives the database another chance to overwrite what was freed.
  • Apps built to leave little behind. End-to-end encrypted apps with disappearing messages turned on are designed so messages don’t linger, on the phone or on the company’s servers.

iPhone vs. Android vs. WhatsApp

There’s no single answer, because each platform and app stores messages differently:

  • iPhone, iMessage and SMS: the Recently Deleted folder (iOS 16 and later) is the big one. Beyond that, database remnants are possible but less predictable.
  • Android, SMS: depends on the phone maker and the messaging app. Database remnants are sometimes recoverable.
  • WhatsApp: in that published test, Android’s database kept deleted messages in its write-ahead log long enough to recover most of them, while the iPhone version left nothing to find. Even on Android, one message the user deleted “for me” was completely gone.
    The practical lesson: anyone who tells you “deleted messages can always be recovered,” or “never,” without knowing the phone, the app and the extraction, is guessing.

The extraction type decides what's even possible

Police don’t just “get the phone.” They run a specific kind of extraction, and it sets the ceiling on what can be found.

A logical or advanced logical extraction mostly collects what the phone presents as live data. It generally can’t reach the database leftovers where deleted messages hide. A full file system extraction copies the app databases in full, including the free space inside them, which is where most deleted-message recovery happens.

So if a report lists a logical extraction and someone is talking about recovered deleted messages, the first question is where those messages actually came from. Here’s how to find the extraction type in a Cellebrite report.

What "deleted" means in a forensic report

When a report marks a message as deleted, that’s the tool’s judgment based on where it found the record. It’s worth checking, because:

  • “Deleted” doesn’t tell you who deleted it. A person, an app’s automatic cleanup and a disappearing-message timer all look similar.
  • Recovered records can be partial. The text may survive while the sender or timestamp doesn’t, or a fragment can be stitched to the wrong conversation.
  • Timestamps on recovered records need extra care. A time attached to a leftover database record may not mean what it appears to, which was the problem behind the 2:27 a.m. timestamp in the Karen Read trial. More on that in what metadata can and can’t prove.

If your messages are at issue

Note: This isn’t legal advice. Talk to your lawyer before you do anything with your phone.

If you’re facing a charge, a protection order or a divorce where messages matter, the most important thing to understand is this: deleting now is the worst move you can make.

Once there’s an investigation or a case, deleting messages can be treated as destroying evidence, and that can create far bigger legal problems than anything in the messages themselves. It also rarely works. The other person still has the conversation, backups may still have it, and an examiner may still find traces of it. All the deletion does is make you look like you had something to hide.

It can also destroy messages that help you. Context that disproves an accusation, or shows that someone else’s screenshots were edited or cherry-picked, often lives on your phone. See can text messages and screenshots be faked?

Keep the phone as it is, back it up, don’t reset or replace it, and tell your lawyer what’s on it. More on that in Falsely Accused? Being Right Isn’t Enough.

 

Questions counsel should ask about "recovered deleted messages"

  • What extraction type was used, and can it reach database leftovers at all?
  • Where exactly was each deleted message recovered from: Recently Deleted, a freelist, a WAL file, a backup, or another device?
  • Is each recovered record complete, or partial? Which fields survived?
  • How was each recovered record tied to a sender, a conversation and a time?
  • Does the other party’s phone, a backup or a carrier record corroborate it?
  • What does the tool’s “deleted” flag actually mean in this version, for this app?
  • Were any deleted messages that help the defense recovered, and were they disclosed?

The takeaway

Deleted messages aren’t always gone, and recovered messages aren’t always what they look like. On a modern phone, what survives depends on the platform, the app, the extraction and time, and every recovered message deserves the same question: where did this come from, and is it complete?

If deleted or recovered messages matter in your case, I offer independent Cellebrite and phone extraction review for counsel. Most cases start with a TruthScan: a flat-rate review that tells you what was actually recovered, from where, and whether it holds up.

Sources