Recovering deleted SMS messages, WhatsApp messages or Messenger conversations requires assessment of the specific material. At first contact, provide the phone model, application, conversation period and any exports and backups you already have. We need to establish what deletion means in this situation and which sources are available. The messaging app’s name alone cannot support a promise to recover the entire conversation.

First explain what stopped being visible

Describe what you have observed: can you no longer see an entire thread, an individual message, an attachment or data after changing phones? Note when you last saw the content and when you noticed it was missing. You do not need to decide yourself whether the cause was deletion, archiving, a different account or changed settings. Each of these possibilities must be assessed against the specific application and available material.

A manufacturer's recovery function is a separate matter from searching for remnants of deleted data. Apple states that, in supported operating system versions, the Messages app allows certain messages deleted within the past 30–40 days to be recovered. This information concerns the specified function and its operating conditions; it is not a guarantee of recovery from any messaging app. If the phone is to be examined, agree on the use of the recovery function before changing its contents. [1]

Deletion does not have a single technical consequence

In applications using SQLite databases, the retention of remnants depends, among other things, on how records are deleted and how the database’s storage is subsequently reused. SQLite documentation describes settings that affect overwriting of deleted content and limitations associated with different table types. The term ‘deleted message’ alone therefore does not tell us whether the text, only a fragment of the record, or no useful trace has survived. [2]

A further limitation is access to encrypted data. Android documentation shows that different areas of storage may have different access conditions. Being able to start a phone or view its screen does not establish that all application data can be acquired. Nor should a result obtained on one phone model be assumed to apply to another device. [3]

Identify available sources and their dates

Prepare an inventory of material you already have: the phone, previous exports, backups, attachments and screenshots. For each item, give its known creation date and provenance. Do not restore successive backups onto the phone under examination merely to ‘check which one contains the conversation’. First agree on how these materials will be used with the person carrying out the analysis.

In practice, a simple list of questions is helpful:

  • Which application and account does the conversation concern?
  • Are you looking for text, an attachment, a date or confirmation of a specific event?
  • What is the narrowest possible time range?
  • What actions were taken after the missing messages were noticed?
  • Is there an earlier export or material provided by a participant in the conversation?
  • Which information is certain, and which is based only on memory?

Such a list makes it easier to agree on the scope and sequence of actions. It also helps determine whether finding an entire conversation or checking a single specific assertion is more important for the case.

What does the examination result mean?

SWGDE recommends taking account of tool limitations, operating system and application versions, and verifying significant findings. Automated extraction results require interpretation in the context of the source data. A complete message, a text fragment and technical information that a record existed are not equivalent findings. It is necessary to state exactly what was found, how it was linked to the conversation and what uncertainties remain. [4]

The conclusion ‘no message was found in the examined material’ describes the scope and result of the search. It does not automatically prove that the message never existed. Likewise, finding a fragment does not justify filling in the missing context. The report should clearly distinguish the content read, conclusions drawn from the analysis and issues the available material cannot resolve.

Hypothetical example

Two people report losing messages on the same day. The first has an earlier export of the entire conversation; the second has only a photograph of the screen. Even with similar phones, the starting points for analysis differ. A responsible assessment will take this material and its limitations into account, rather than promise an identical result based solely on the time elapsed since the incident.

Sources

Primary documents; accessed: 23 October 2026.

Digital forensics—scope of examinations →