Home · Guides · updated 2 September 2026

Can deleted messages be recovered for evidence?

The honest answer disappoints people, so it is worth giving plainly: not from an export, and not by any application promising otherwise. What does exist is narrower and slower.

What deletion actually does

• Delete for me. The message is removed from that device. The other participant still has it.
• Delete for everyone. Within the window the application allows, the sender removes it from both devices, and what remains is a line recording that a message was deleted.
• Disappearing messages. Set on the conversation, messages are removed after the chosen period, on both sides.
• Clearing the chat, or the media. Removes content from the device wholesale, and cleared media cannot be exported even with a with-media export.

In every case, the export written afterwards contains what is on the device at that moment. It is a snapshot, not a log — see the limits of an export.

Why the recovery products do not help you

The category advertises otherwise, and the claims fall into a few kinds, none of which produce evidence:

• Notification-history readers. Some Android builds keep a log of notification text, and a third-party app can surface it. What that yields is a notification, on your phone, recorded by an unrelated application — not the message, and with a provenance story considerably worse than the chat’s.
• “Recovery” applications. Overwhelmingly these restore a backup, which you can do without them, or they read nothing at all.
• Anything requiring the other person’s account. Accessing an account you are not entitled to is an offence, and evidence obtained that way brings a much larger problem into the case than the message solves.

What genuinely exists

1. Another participant’s copy. A message deleted only on your device still exists on theirs, and in a group it exists on every participant’s handset. Where a participant is willing, their export — certified in their own name — is the cleanest answer. See who signs Part A.
2. An application to the court. Where the deleted content is material and held by the other side, the route is an application for production of the record, and where appropriate for the device to be examined by an expert. This is slow, it is discretionary, and it needs a reason better than curiosity — but it is the route that exists.
3. Forensic examination of a device you control. Deleted content is sometimes recoverable from a handset by an examiner, depending on the device, the time elapsed and how much has been written since. It is expensive, it is not guaranteed, and it requires the phone to have been left alone.
4. A backup taken before the deletion. Restoring it reproduces the state at that time. It overwrites the current handset, so it is done on a different device, and never on a phone that is itself in issue.

The fact of deletion is itself evidence

This gets overlooked. Where the application records that a message was deleted, the record shows that a message existed at that point in the conversation and was withdrawn. That is a fact, it has a timestamp, and in context it can be worth as much as the content would have been — a deletion in the middle of the material exchange, at the material time, is not a neutral event.

So count them and state the number. An exhibit that reports how many entries in the range were recorded as deleted has put the point in front of the court properly. One that quietly omits them has left the other side something to find.

If you think messages may be deleted

Act before it happens rather than after:

• Export now. The export fixes what exists today. Later deletions cannot reach it. How to export.
• Hash it and record the value, so the date of production is fixed too.
• Do not delete anything yourself, including messages that do not help you. Selective production is a much easier attack than an unhelpful message.
• Leave the device alone if examination is a realistic prospect. Continued use overwrites exactly the space deleted content might survive in.

What an exhibit should say about it

That deleted entries were found, how many, and where they fall in the range. Not that the conversation is complete. A record described as complete which visibly is not is one discovery away from being worthless; a record that states its own gaps is one the court can weigh.

---

This guide explains procedure and states the law as we understand it. It is not legal advice, and Aarohan Enterprises is not a law firm. Whether a court admits a particular record, and what weight it gives it, is for that court to decide. Have an advocate settle anything you intend to file.