Deleted WhatsApp Chats are Not Gone Forever Says iOS Researcher

by Chaitanya Vankadaru 2


Deleted WhatsApp chats are not gone forever says a iOS researcher. Even the trashed WhatsApp chats can be retrieved and decrypted. The traces can be found in the database of WhatsApp (stored in the mobile device). So anyone who can get physical access to the device can decrypt and read the message. Jonathan Zdziarski, an iOS researcher discovered this intruding feature of WhatsApp. Messaging network WhatsApp’s security and privacy measures are put into question. Users welcomed the introduction of End-to-End encryption but these events annoy them the most. WhatsApp is updating itself with many new and awesome features time to time. And one of such features is End-to-End Encryption by WhatsApp. Which actually means WhatsApp does not store your data directly, you get to retrieve and use your data with an highly protective end-to-end encryption. But, the problem here in the latest version is a typical one.

Related:   Google Driving App Shortcut - New feature added to Google Maps

Sorry, Folks. I’m saying true. The Latest Version of WhatsApp seems to leave the traces of all your chats, even if you delete them. Same goes for hidden or archived messages or chats category too. Which means even if you use “Clear All Chats” option in your WhatsApp, we can trace all your chats by the help of this Forensic Tracing. Because, the latest version of WhatsApp seems to have a bug/error in this issue. Or may be we can say it’s just a hidden tricky thing only known to Geeks of certain category.

And it leaves us only one option to clear all traces of WhatsApp, only by uninstalling and deleting WhatsApp from your Device.

Official Sources Words:

In Zdziarski’s blog, he says, “To test, I installed the app and started a few different threads. I then archived some, cleared, some, and deleted some threads. I made a second backup after running the “Clear All Chats” function in WhatsApp. None of these deletion or archival options made any difference in how deleted records were preserved. In all cases, the deleted SQLite records remained intact in the database.

Related:   Quora is in Love with Experimenting - And it never stops.

To be clear and precise, WhatsApp itself is trying to delete the record, but those records itself are not being deleted from the database. Which means they are leaving a ‘Forensic Artifact‘. Which can be recovered and restored back into its primary form.

WhatsApp Forensic Traces
WhatsApp Forensic Traces

And one most relieving thing for Smartphone users is that “This Problem is only seen in iOS devices, that too, due to the Forensic Traces being left behind because of SQLite. SQLite doesn’t empty the database due to it’s complexity, which helps the left behind Forensic Traces.

Related:   WhatsApp's Upcoming Feature - Pinned Chats

However, I presume, WhatsApp developers will solve this problem so soon, if I’m not wrong at my end. And, there is one question left in your minds after reading this article. “Are we safe from this?“. You are absolutely safe from this in general. But, if you’re doing something terrible and any Investigation Dept. take on you, then, it will be surely hell for you. You might understand what I’m saying then.

And even now, if you want the protection for your database, then use an alternative storage backing such as raw files, or encrypted Core-Data, which will be most secure option. In plus to it, Apple’s file-level encryption is very solid in handling deleted files.

Thanks for reading. Get more stuff like this in your inbox:  Subscribe to our newsletter.