WhatsApp Data Recovery: Deleted Messages, Photos & Evidence
WhatsApp data recovery is our forensic specialty. We recover deleted WhatsApp messages, photos, videos, and voice notes using court-admissible forensic extraction from Android and iOS devices, even without backups.
ACE Lab
Cellebrite
Oxygen Forensics
WhatsApp Recovery Assessment
Answer 5 questions to get a realistic assessment of your recovery prospects.
What type of phone do you need messages recovered from?
What is the current state of the phone?
How were the messages deleted?
How long ago were the messages deleted?
Do you have a WhatsApp backup (Google Drive, iCloud, or local)?
Assessment Complete
Quick Recovery Tools
Assess your situation quickly before contacting us.
Recovery Window Calculator
Estimate how much time you have before deleted messages become unrecoverable.
Cost Estimator
Get an approximate cost range for your WhatsApp data recovery case.
Is My Backup Useful?
Check whether your existing backup can help recover the deleted messages.
Extraction Method Finder
Find out which forensic extraction method applies to your specific device.
How WhatsApp Data Recovery Works: Storage and Deletion
Understanding how WhatsApp stores messages is the first step. All messages live in an SQLite database on your device. On Android, this database is msgstore.db, stored in the app's private directory. On iOS, it's ChatStorage.sqlite, located within the app sandbox. Understanding how these databases work is fundamental to recovering deleted messages.
When you delete a WhatsApp message, the app doesn't overwrite the data. According to research published by forensic analyst Jonathan Zdziarski, SQLite databases handle deletion by adding the deleted record's page to an internal "freelist." The actual message content remains in the database file until the space is needed for new data and the pages are reused.
Three Types of WhatsApp Deletion
- Delete for Me: Removes the message from your local database only. The other party still has it. The SQLite record is moved to the freelist and remains recoverable until overwritten by new messages.
- Delete for Everyone: Sends a revocation command to all participants. However, comparative research by Belkasoft shows the original message content frequently persists in the
message_quotedtable if someone quoted the message before deletion, and in SQLite WAL (Write-Ahead Logging) files on Android between database checkpoints. - Clear Chat / Delete Chat: Removes the entire conversation. This performs a bulk delete in SQLite, and while freelist pages are generated, the sheer volume means pages are reused faster. Recovery is still possible but time-sensitive.
Recover Deleted WhatsApp Messages: Android vs iOS
The operating system your phone runs fundamentally changes what forensic extraction can achieve. Android and iOS handle app data, encryption, and database maintenance differently, creating distinct recovery windows and methods.
Android WhatsApp Recovery
Android devices offer more recovery pathways because WhatsApp stores local encrypted backups (.crypt14 / .crypt15 files) in the device storage. The msgstore.db database retains deleted records in SQLite freelists, and WAL files preserve pre-deletion states between checkpoints.
Forensic tools like Cellebrite UFED use APK Downgrade extraction on Android 6.0+ to access WhatsApp data that standard logical extraction cannot reach, because WhatsApp opts out of Android's standard backup mechanism (as documented by Privacy International).
Samsung devices benefit from Cellebrite's Smart Flow, which provides file system level access on a wide range of Qualcomm and Exynos chipsets without security patch level restrictions on unlocked devices.
iOS WhatsApp Recovery
iOS recovery is more challenging because Apple's operating system aggressively manages SQLite databases with more frequent vacuuming, which physically removes freelist pages. The recovery window is shorter compared to Android.
For iPhone 5s through iPhone X (A7 to A11 chips), the checkm8 bootrom exploit enables full file system extraction regardless of iOS version, providing direct access to the ChatStorage.sqlite database and any WAL/journal files.
For iPhone XS and newer (A12+ chips), extraction typically requires an unlocked device or Cellebrite Premium. Oxygen Forensic Detective can perform cloud extraction by capturing the WhatsApp QR token to access linked devices and cloud data.
| Factor | Android | iOS |
|---|---|---|
| Database File | msgstore.db | ChatStorage.sqlite |
| WAL File Recovery | Excellent | Limited |
| Local Backups | .crypt14/.crypt15 on storage | Within iTunes/Finder backup |
| Cloud Backups | Google Drive (encrypted) | iCloud (encrypted) |
| Forensic Extraction | Smart Flow, APK Downgrade | checkm8 (A7-A11), Premium (A12+) |
| SQLite Vacuuming | Less Aggressive | More Aggressive |
| Recovery Window | Days to weeks | Hours to days |
Which Recovery Path Applies to You?
WhatsApp Data Recovery Methods We Use
Our forensic approach combines multiple extraction techniques depending on your device, its condition, and the type of deletion. Each method targets different data sources where deleted WhatsApp content may persist.
SQLite Freelist Analysis
We parse the raw SQLite database file to extract records from freelist pages, overflow pages, and unallocated space within the database. This recovers messages that were "deleted" but not yet overwritten by new data.
WAL File Extraction
Android's Write-Ahead Logging preserves pre-checkpoint database states. We extract the WAL and journal files to recover messages that existed before the most recent SQLite checkpoint, even if the main database no longer contains them.
Backup Decryption
Android .crypt14 backups are decryptable with the device's encryption key stored in the app's private directory. .crypt15 (end-to-end encrypted) backups require the user's 64-character key. We use wa-crypt-tools and forensic decryption toolsets.
Cloud Extraction
Oxygen Forensic Detective can capture WhatsApp cloud data via QR token acquisition from unlocked devices, accessing Google Drive or iCloud backups that may contain messages predating the deletion event. This requires the device owner's authorisation.
APK Downgrade Extraction
Cellebrite's APK Downgrade method temporarily replaces WhatsApp with an older version that allows data extraction via Android's backup mechanism. This overcomes WhatsApp's opt-out of android:allowBackup on Android 6.0+ devices.
Chip-Off / ISP Extraction
For physically damaged or factory-reset devices, we desolder the NAND flash memory chip and read it directly using a chip reader or ISP (In-System Programming) connection. This bypasses the phone entirely and accesses raw storage where deleted SQLite data may persist.
Device Compatibility Database
Search our database of tested devices and their WhatsApp data recovery extraction methods. Data sourced from Cellebrite February 2025 support matrix, NIST CFTT test results, and our own lab testing.
| Device | Chipset | Extraction (Unlocked) | Extraction (Locked) | WhatsApp Access |
|---|
Obstacles to Recovering Deleted WhatsApp Messages
Recovery is not guaranteed. Several technical factors can reduce or eliminate recovery prospects. We are transparent about these limitations because understanding them helps you make informed decisions about your case.
End-to-End Encryption
WhatsApp messages are encrypted in transit, but stored decrypted on the device. Encryption only blocks interception, not device-level forensic extraction.
SQLite VACUUM
iOS performs SQLite vacuuming more aggressively than Android. This physically removes freelist pages, permanently destroying deleted message remnants.
TRIM on Flash Storage
Modern phones use flash storage with TRIM. After a factory reset, TRIM can erase blocks containing the WhatsApp database before forensic tools can image the device.
Continued Phone Usage
Every new message, photo, or app update writes data that can overwrite freelist pages. The longer you use the phone after deletion, the lower the recovery rate.
Device Lock / Encryption
Locked newer iPhones (A12+) and Pixels with strong passwords and current security patches significantly limit extraction capabilities without the passcode.
Crypt15 Backup Encryption
WhatsApp's newer end-to-end encrypted backups (crypt15) require the user's 64-character encryption key. Without this key, cloud backup extraction is not possible.
WhatsApp Message Recovery: Common Scenarios
We handle a wide range of cases. Here are the scenarios we see most frequently and what each involves.
Legal / Family Law
Recovery of evidence for court proceedings, including conversations, threats, or agreements. We provide court-admissible forensic reports with full chain of custody documentation and expert witness availability.
Workplace / HR Disputes
Recovery of workplace conversations, harassment evidence, or policy violations communicated through WhatsApp groups. Extraction maintains forensic integrity for tribunal proceedings.
Personal / Accidental Deletion
Accidentally deleted conversations with sentimental value, important information, or contact details. Standard forensic extraction with faster turnaround and lower cost tier.
Fraud / Scam Investigation
Recovery of conversations with scammers or fraudsters who deleted messages to cover their tracks. We extract deleted content, timestamps, and sender identification for police reports.
WhatsApp Business vs Personal: Recovery Differences
WhatsApp Business and standard WhatsApp store data differently, which affects how WhatsApp data recovery is performed. If the target device used WhatsApp Business, our forensic approach accounts for these differences.
Personal WhatsApp
Database: msgstore.db (Android) / ChatStorage.sqlite (iOS). Package: com.whatsapp. Standard backup encryption (.crypt14/.crypt15). Single phone number per device. Messages, media, voice notes, and status updates stored in a unified database structure.
WhatsApp Business
Database: msgstore.db in separate package directory. Package: com.whatsapp.w4b. Separate backup files from personal WhatsApp. Additional data: catalogue items, quick replies, automated messages, labels. Both apps can run simultaneously on the same device with different databases.
Legal Admissibility of WhatsApp Evidence in Australia
Under the Evidence Act 1995 (Cth) and its state equivalents (the Uniform Evidence Acts), digital evidence including WhatsApp messages is admissible in Australian courts if it meets three requirements: relevance, authenticity, and lawful obtainment.
Why Forensic Extraction Outweighs Screenshots
Australian courts are increasingly cautious about screenshot evidence. As noted by the Supreme Court of Tasmania, the burden of proving authenticity lies with the party submitting the evidence. Screenshots can be fabricated, cropped, or taken out of context. A forensic extraction provides:
- Hash verification (MD5 and SHA256) proving the data has not been altered since extraction
- Complete chain of custody documentation from device intake to report delivery
- Full conversation context (not selective screenshots) with original timestamps
- Database metadata showing message delivery status, read receipts, and edit history
- Deleted message recovery that screenshots cannot capture
- Expert witness testimony available to explain methodology and findings to the court
What You Receive: Forensic Report and Deliverables
Every WhatsApp data recovery case includes a comprehensive forensic report. For legal cases, this report is formatted for court submission. Here is what a typical report contains:
EXAMINER: Viktor Burcevski, Cellebrite CCO
CLIENT: REDACTED
DEVICE: Samsung Galaxy S24 Ultra (SM-S928B)
IMEI: REDACTED
EXTRACTION METHOD: Cellebrite UFED Smart Flow
EXTRACTION TYPE: Full File System
IMAGE HASH (SHA256): a7f3c9...e41b
WHATSAPP ANALYSIS:
Active messages recovered: 12,847
Deleted messages recovered: 342
Media files recovered: 1,205
Contacts extracted: 89
CHAIN OF CUSTODY: Documented
COURT-ADMISSIBLE: Yes
Deliverables Included
- PDF forensic report with methodology, findings, hash values, and chain of custody log
- Recovered messages exported as searchable HTML with original timestamps
- Recovered media files (photos, videos, voice notes, documents) in original format
- SQLite database copy for independent verification by opposing counsel if required
- Excel spreadsheet of all recovered messages with sender, recipient, timestamp, and content
- Expert witness availability for court appearance (quoted separately)
Case Studies: Real Recovery Examples
The following are anonymised examples from real WhatsApp data recovery cases we have handled. Details have been changed to protect client confidentiality.
Family Law: 3 Months of Deleted Conversations
Client's former partner deleted WhatsApp conversations containing evidence of threats and coercive control. Messages deleted over 3 months using "Delete for Me." Forensic extraction recovered 94% of deleted messages from SQLite freelists. Evidence admitted in Federal Circuit Court.
Employment Dispute: Deleted Group Chat Evidence
Employee accused of sharing confidential information via WhatsApp group. Group chat cleared by all participants. WAL file analysis recovered complete group conversation including timestamps, proving the information leak timeline. Used in Fair Work Commission proceedings.
Fraud Investigation: Messages From Water-Damaged Phone
Client's phone suffered water damage after receiving threatening WhatsApp messages from a scammer. Device would not power on. Chip-off extraction of NAND flash recovered WhatsApp database. Deleted and active messages provided to Queensland Police.
Personal Recovery: Accidentally Cleared Chat
Client accidentally selected "Clear Chat" on conversation containing last messages from a deceased family member. Contacted us within 2 hours. Immediate forensic extraction recovered all messages and voice notes from SQLite freelist pages before any overwriting occurred.
Our Forensic Recovery Capabilities
Our Forensic Recovery Process
Every extraction follows strict chain of custody protocols aligned with Australian forensic evidence standards.
Initial Case Assessment Free
We evaluate your device type, deletion scenario, and forensic extraction prospects. You receive an honest assessment of what's recoverable before any commitment. If the prospects are poor, we tell you upfront.
Evidence Intake & Chain of Custody
Your device is logged, photographed, and sealed with tamper-evident packaging. A chain of custody document is initiated, recording every person who handles the device.
Forensic Imaging
We create a verified forensic image of the device using write-blocked connections and Cellebrite UFED or Oxygen Forensic Detective. All analysis is performed on the image, never the original device. Hash verification (MD5/SHA256) ensures data integrity.
WhatsApp Database Analysis
We locate and parse the WhatsApp SQLite database, WAL files, journal files, and local encrypted backups. Deleted records are extracted from freelist pages, unallocated database space, and the message_quoted table.
Report & Evidence Delivery
You receive recovered messages in a structured forensic report. For legal cases, the report includes methodology documentation, hash values, chain of custody records, and is formatted for court submission.
Pricing & Fees
Transparent pricing with No Data, No Fee guarantee. You only pay if we successfully recover your messages.
Forensic Extraction Pricing
All prices in AUD, GST inclusive unless stated
No Data, No Fee guarantee applies to all forensic extractions. Free initial assessment. Payment by Square invoice (bank transfer, credit card, or payment plan available).
Need Professional WhatsApp Data Recovery?
Court-admissible forensic extraction from Android and iOS devices. No Data, No Fee guarantee.
Frequently Asked Questions
Yes, in many cases. When a sender uses "Delete for Everyone," the message is removed from the chat interface, but forensic traces frequently persist. On Android, the WAL file may contain the original message if a database checkpoint hasn't occurred. Additionally, if anyone quoted the message before deletion, the full content is preserved in the message_quoted table. The recovery window is time-sensitive, so contact us as soon as possible.
Yes. Backups are helpful but not required for WhatsApp data recovery. Our primary approach targets the device's local SQLite database directly. Deleted messages remain in the database's freelist pages and WAL files until overwritten. Forensic file system extraction using Cellebrite or Oxygen can access this data regardless of backup status.
Forensic WhatsApp extraction starts from $1,500 for a working, unlocked device. Chip-off extraction for dead or factory-reset devices starts from $2,200+GST. All prices include a court-admissible forensic report. Our No Data, No Fee guarantee means you only pay if we successfully recover messages.
Yes. All our forensic extractions follow strict chain of custody protocols. The forensic report includes extraction methodology, hash verification (MD5 and SHA256), timestamps, chain of custody documentation, and is formatted for court submission. Our lead forensic engineer is available as an expert witness.
Recovery after factory reset is challenging but sometimes possible using chip-off extraction, where we desolder the NAND flash chip and read it directly. Success depends on whether TRIM has erased the storage blocks containing the WhatsApp database. iPhones with Secure Enclave (iPhone 6 and later) encrypt data with a hardware key that is destroyed during factory reset, making post-reset recovery extremely difficult on iOS.
It depends on the device. iPhones with A7 to A11 chips (iPhone 5s through iPhone X) can be extracted using the checkm8 bootrom exploit regardless of lock state or iOS version. Newer iPhones (XS and later) require Cellebrite Premium. Samsung and other Android devices vary by chipset and security patch.
Standard forensic extraction takes 3-7 business days, including the forensic report. Emergency priority service is available for an additional $990, which prioritises your case for completion within 24-48 hours where technically feasible.
Stop using the phone immediately. Do not send or receive new WhatsApp messages. Do not update apps or the operating system. Do not factory reset the device. If possible, put the phone in aeroplane mode to prevent automatic updates and new message delivery. Contact us for a free assessment.
Request a Free Assessment
Describe your case and we'll provide an honest evaluation of recovery prospects.
Enquiry Sent
We'll review your case and respond within 2 business hours. For urgent matters, call 1300 806 557.
References & Further Reading
- Belkasoft: WhatsApp Forensics Comparative Analysis
- Zdziarski: iOS SQLite Forensic Research
- Privacy International: WhatsApp and Mobile Forensics
- wa-crypt-tools: WhatsApp Backup Decryption
- Osservatorio Nessuno: Cellebrite Android Support (Feb 2025)
- Cellebrite: UFED Product Overview
- NIST CFTT: Cellebrite UFED Test Results (2025)
- SQLite: Write-Ahead Logging Documentation
- Evidence Act 1995 (Cth) - Australian Government
- Cellebrite: Smart Flow & APK Downgrade
