WhatsApp Forensic Artifacts: Chats Aren’t Being Deleted

Forensic artifact means deleted chats can be recovered.

by Jonathan Zdziarski

Sorry, folks, while experts are saying the encryption checks out in WhatsApp, it looks like the latest version of the app tested leaves forensic trace of all of your chats, even after you’ve deleted, cleared, or archived them… even if you “Clear All Chats”. In fact, the only way to get rid of them appears to be to delete the app entirely.

To test, I installed the app and started a few different threads. I then archived some, cleared, some, and deleted some threads. I made a second backup after running the “Clear All Chats” function in WhatsApp. None of these deletion or archival options made any difference in how deleted records were preserved. In all cases, the deleted SQLite records remained intact in the database.

To read the entire article, please click here.

Source: http://www.zdziarski.com/

Facebooktwittergoogle_plusredditlinkedinmail