FORENSICS GUIDE
Can deleted WhatsApp messages be recovered?
The short answer: yes, where the data is still recoverable. Results depend on the device, its settings and whether the data has been overwritten, so we assess the phone before quoting.
Last reviewed
Why the answer is conditional
That is the honest position. Sometimes messages removed from a chat can be brought back in full, sometimes only fragments of a conversation remain, and sometimes nothing useful is left. Nobody can say which before the phone has been examined, and anyone who promises a result without seeing it is guessing.
When a message is removed, the phone usually marks the space it used as free rather than wiping it at once. Until new data is written into that space, traces may survive in the app’s own database or elsewhere on the handset. What decides how much survives:
- The device: phones differ in how they store and encrypt data, and in what an examiner is able to extract from them.
- Its settings: encryption, security updates and whether chat backups were switched on all affect what can be reached.
- Overwriting: every new message, photo and app update uses storage. The more the phone is used after the removal, the more likely the old data has gone.
- Time: a removal from yesterday generally leaves more to work with than one from last year, though not in every case.
Could a backup hold older messages?
A backup can be worth more than the phone itself. WhatsApp can save chat backups to a cloud account linked to the phone, and some phones also keep local copies or full device backups. A backup made before the messages were removed may still contain them.
Backups have limits. They are replaced on a schedule, they may be encrypted, and restoring one onto the phone usually replaces what is there now. Do not restore an old backup yourself in the hope of finding messages, because you could lose newer data in the process. Tell the examiner which backups you think exist and leave them alone.
The other person in the conversation may also still hold the messages on their phone or in their own backup. That can be a simpler route, with their agreement.
What should I avoid?
- Do not carry on using the phone heavily. New photos, videos, downloads and chats all take up storage that may still hold the old data.
- Do not factory reset the phone. A reset can make earlier data unreachable.
- Do not install recovery apps from the internet. Installing one writes new data to the phone, many do not work as claimed, and some are harmful.
- Do not uninstall and reinstall WhatsApp, or change its backup settings, until you have taken advice.
- Do not hand the phone to a repair shop or a friend to “have a look”.
- Keep the phone charged, safe and with you, and note anyone else who has had it.
If the messages matter to a dispute, a complaint or a workplace matter, stop using that phone for anything important and get advice quickly. Normal daily use can reduce what is left.
How does an assessment work?
First conversation
You tell us what was removed, roughly when, which phone it was on and what backups may exist. Initial consultations are without obligation; charges apply only once work begins.
Intake
The phone is logged on a chain-of-custody record when it arrives, and its condition is photographed.
Assessment and estimate
We look at the handset and its settings to judge what is realistic, then explain the options. It depends on the case; we give an estimate before work begins.
Extraction
We use physical or logical extraction, depending on what the device and its security settings allow. Physical extraction aims to capture the storage as a whole; logical extraction captures the files and app data the phone makes available.
Analysis
The WhatsApp database and related files are examined for the conversations you asked about, including entries that were removed, where the data is still recoverable.
What do I receive?
You receive a written report of what the extraction found, with a timeline of the relevant messages and the extracts behind it. If the report is to be relied on in proceedings, its weight is a matter for the court. Whether evidence is admitted is decided by the court in each case.
Terms in this guide
Questions
Can messages deleted for everyone be recovered?
Sometimes, where the data is still recoverable. Deleting for everyone removes the message from the other phones in the chat too, so what remains depends on each device and on any backups.
Do WhatsApp recovery apps work?
Some find traces, but installing one writes new data to the phone and can overwrite what you hoped to find. If the messages matter, avoid them and get advice first.
Can messages be recovered after a factory reset?
It is much less likely, because a reset usually makes earlier data unreachable. A backup made before the reset may be the only remaining source.
How much does WhatsApp recovery cost?
It depends on the case; we give an estimate before work begins.