Recovered, Not Deleted: WhatsApp Evidence in a Harassment Investigation

A complainant reported a pattern of threatening messages sent via WhatsApp, but stated the sender had deleted several key messages for both parties shortly after sending them, and the underlying conversation was no longer visible in the app on either device. With a valid consent form from the complainant and a court order for the respondent's device, examiners set out to determine whether deleted-for-everyone messages could still be recovered.

• Complainant's Android device (consented extraction)
• Respondent's Android device (court-ordered extraction)
• WhatsApp cloud backup metadata (with account-holder consent, complainant side only)

• Magnet AXIOM (physical extraction and WhatsApp parsing)
• DB Browser for SQLite (manual msgstore.db inspection)
• ALEAPP (automated Android artifact parsing)

• Performed a physical extraction of both devices to obtain access to the full file system, including the WhatsApp app's private data directory rather than a logical backup, since 'deleted for everyone' messages are removed from the visible chat but can persist in underlying database structures.
• Located msgstore.db and its associated Write-Ahead Log (msgstore.db-wal) file, which had not yet been checkpointed back into the main database at the time of acquisition.
• Parsed the WAL file directly, since deleted rows are often still present in WAL frames that haven't been merged and vacuumed into the primary database file.
• Cross-referenced recovered message rows against the message-deletion protocol markers WhatsApp writes when a 'delete for everyone' action occurs, distinguishing genuinely deleted content from normal message history.
• Extracted the SQLite freelist pages from the main msgstore.db to search for further remnants of records whose space had been marked free but not yet overwritten.
• Corroborated recovered timestamps against WhatsApp's own server-side delivery/read receipt data preserved in a separate table, strengthening confidence that recovered content was genuine and not artificially reconstructed.
• Extracted associated media thumbnails cached separately from the deleted messages, which had not been removed by the deletion action and independently corroborated the recovered text content.

• Six messages recovered from WAL frames that matched the complainant's description of the harassment content, timestamped within the disputed window
• 'Delete for everyone' protocol markers confirming the messages had in fact been sent and later actively deleted by the respondent, rather than never sent at all
• Cached image thumbnails corroborating one recovered message that referenced an attached photo

• A logical (app-level) extraction alone would not have surfaced this evidence at all — the physical extraction and direct SQLite file access was essential.
• WAL-based recovery is time-sensitive: had the app been reopened many more times before seizure, WhatsApp's periodic checkpoint process could have overwritten the WAL content, permanently destroying the recoverable remnants.
• Establishing forensic soundness of a hand-parsed SQLite WAL recovery required detailed documentation of the exact byte offsets and record structures relied upon, since this analysis step was manual rather than fully tool-automated.

The recovered messages, combined with the deletion markers proving intentional destruction of evidence, were admitted and materially strengthened the harassment complaint. The case proceeded to a formal hearing with the recovered chat log as a central exhibit.

'Deleted' rarely means 'gone' in SQLite-backed applications — WAL files and freelist pages are a frequently overlooked recovery surface. Physical extraction should be the default target tier whenever legally and technically available, since logical backups systematically under-recover this class of evidence.