The Myth of Disappearing Message

Sammanfattning

The increasing use of disappearing message features in modern communication applications presents new challenges for digital forensic investigations and raises questions about the assumption that such messages truly “disappear”. This study examines whether such features leave traceable forensic artefacts on unrooted Android devices, with a focus on WhatsApp, Messenger and Instagram. A quantitative experiment method was applied in which controlled communication activities were generated on two Android devices (Samsung Galaxy A55 and Samsung Galaxy A20) with different Android versions. After automatic deletion of messages, logical images of both devices were acquired and analysed using Magnet AXIOM, Autopsy and manual database analysis. The results show that no directly readable message content or chat records could be recovered from the examined applications. Encrypted databases were identified most notably for WhatsApp, although their content was not accessible without decryption keys. System-level artefacts such as SMS/MMS messages and metadata in contact databases were successfully recovered. The findings indicate that application-level encryption, Android sandboxing and disappearing message functionality significantly limit data accessibility during logical acquisition. At the same time residual metadata persists, meaning that communication patterns can still be partially reconstructed.