WhatsApp ‘Doesn’t Fully Delete Messages’

Deleted WhatsApp messages could be easy to recover, with unencrypted copies stored on iCloud, a researcher finds

Weeks after WhatsApp began using end-to-end encryption to protect users’ communications, a researcher has found that the service leaves traces of deleted posts that could be easily recovered.

“The latest version of the app tested leaves forensic trace of all of your chats, even after you’ve deleted, cleared, or archived them… even if you ‘Clear All Chats’,” wrote Jonathan Zdziarski in an advisory. “In fact, the only way to get rid of them appears to be to delete the app entirely.”

Zdziarski found that when users delete messages, the app only removes the indicators that point to where the content is held in the database, but leaves the content itself unchanged.

The messages may or may not be overwritten by further data, but if not, the chat content could be recovered using forensics tools, said Zdziarski, who tested the iOS version of WhatsApp.

“SQLite by default does not vacuum databases on iOS,” he wrote. “There is no guarantee the data will be overwritten by the next set of messages. In other apps, I’ve often seen artifacts remain in the database for months.”

The data remains not only on the iOS device, but is also copied when the device is backed up to desktops and iCloud. The desktop backup can be encrypted by selecting an iTunes option, but this doesn’t apply to iCloud backups, meaning that data remains in an unencrypted form.

“When that data comes off the device as freely as WhatsApp’s database does, it poses a rather serious risk to privacy,” Zdziarski added.

The privacy of electronic messages came to public attention beginning in 2013 with the disclosure of mass surveillance programmes by the US government, leading Google, Apple and others to adopt encryption for their communications systems.

:story: TechWeekEurope