Deleted doesn't mean undetectable — how to recover evidence from WhatsApp

In the age of digital communication, applications such as WhatsApp are often used not only for everyday conversations but also – unfortunately – for criminal activity. Increasingly, in criminal proceedings, messages sent via internet messengers carry significant evidentiary weight, even if they were later deleted by one of the parties.

The case below shows that, with the right digital-forensics tools, it is possible to demonstrate that a conversation existed, even if the content of the messages has been erased.

WhatsApp and deleted correspondence – can it be detected?

In the case analysed, the victim's phone (an iPhone) revealed a WhatsApp conversation with a user labelled as "MR A", who was using a Samsung (Galaxy) device. The content of this conversation, of a paedophilic nature, was secured for use in proceedings.

Notably, a significant portion of the messages had been deleted by the parties. As the analysis showed, deleting the conversation had been agreed in advance by the users and was referred to in the correspondence by the slang abbreviation "czk" – from Polish youth internet jargon, short for "czyszczenie konwersacji" ("clearing the conversation").

How does WhatsApp's message-deletion mechanism work?

WhatsApp offers a "Delete for everyone" option, which makes a message disappear from both the sender's and the recipient's device. However – importantly – certain data remains in the application's system databases.

In the case in question, although the content of the conversation was not found on the defendant's phone, an entry corresponding to the victim's number survived in the jid table of WhatsApp's internal database (msgstore.db). This table stores information about contacts with whom the user had any form of interaction – regardless of whether the messages were later deleted. The presence of an entry in this table indicates that the victim's number appeared on the defendant's device. Because the jid table also gathers contacts from address-book synchronisation and group membership, the entry alone does not yet establish the content or the fact that a conversation took place — its evidentiary value is strengthened only by other, correlated traces.

Moreover, the same number also appeared in the wa_block_list table, which shows that the user blocked the contact after the exchange ended. Combined with the absence of messages and the absence of a chat in the conversation list, this data indicates, with high probability, the deliberate and conscious deletion of the communication history.

Was it possible to impersonate the user?

The analysis ruled out the possibility of the WhatsApp account being taken over by a third party – no signs of SIM-card duplication, use of WhatsApp Web or a companion app were found. This means that the messages received by the victim could only have come from the actual user of the Samsung Galaxy phone, who had access to the MSISDN number used by "MR A".

The end-to-end encryption used by WhatsApp ensures the confidentiality and integrity of messages during transmission — protecting them from being read by third parties. It does not, however, confirm the identity of the person physically operating the device: in evidentiary terms it points to a specific device and account, and linking them to the defendant requires additional findings (seizure of the phone, login data, correlation with other traces).

Conclusions for court practice

The analysis of WhatsApp data showed that:

• even deleted messages can leave technical traces behind (e.g. in the form of entries in the application's databases),
• the presence of an entry in the jid table without accompanying messages points to the conversation having been deleted,
• the presence of the same number in the wa_block_list table additionally confirms that the action was intentional,
• technical data can show that communication existed earlier, even if the device no longer contains its content.

For law enforcement, prosecutors and the court, this means that deleting messages in the app does not prevent their detection or the legal assessment of the perpetrator's intent.

If your proceedings require the recovery or verification of deleted digital communication, we provide services in digital-data analysis, digital forensics and the preparation of court opinions.