Deleted Text Messages

I often get asked about deleted text messages on cellular devices, specifically SMS or MMS messages on cellular devices.

• Can I recover them?
• Can the police obtain them?
• Can my spouse obtain them and use them against me in a pending divorce?
• Can I see who my kid has been texting?

Whether deleted means deleted must be explored from a few different perspectives.

The type of device can be a factor, specifically whether it is an Android or iOS device. Unless specifically instructed, an iOS device will store deleted SMS/MMS messages for about 30 days, and they can be restored directly on the device during that retention period. That is one example of many.

Cellular carriers, such as Verizon, AT&T, US Cellular, T-Mobile, and others, may store the content of text messages for a few days up to several weeks, depending on a variety of factors, before it is overwritten and gone. Each carrier has its retention schedule, and this can vary depending on a variety of internal factors as well. Some cellular carriers may not store the content of the text messages at all. Most cellular carriers maintain records of the metadata information from SMS/MMS messages sent through their systems for periods. The metadata and text message content, if it exists at the time of the request, can be obtained by law enforcement with consent or court orders, parents in the case of juveniles, and account holders from the cellular carriers if the data exists. Specifically, the retention of the actual content of the message may or may not exist, but evidence that a message or messages were sent may still exist. Dealing with the cellular carriers can be cumbersome for non-law enforcement personnel as well, as language in the request often needs to be specific and contain proper terminology that can differ between cellular carriers and needs to be specific to obtain the necessary information. Response times can also vary, which can cause unexpected delays in receiving information.

When discussing deleted messages, one should think outside of the cellular device that also sent or received the messages. A device also sends or receives the message(s). A message may be deleted and cannot be recovered from the originating device but may be retrieved from the receiving device if it has not been permanently removed. Many times, people may screenshot messages to preserve them, so there may be evidence of a message or messages in some location on a device other than the messaging application. Someone may have forwarded message(s) to a third party not involved in the original message or referenced the content of a message when discussing with a third party that may be of significance. There are also options for recovering deleted data from the numerous texting applications that one can use for messaging. In some cases, messages are backed up by the user to Google or iCloud, and messages can be recovered from those locations, even though they do not appear on the cellular devices themselves.

Numerous scenarios pertaining to deleted text messages, and I have included some examples of some of the common scenarios related to deleted text messages. A digital forensic expert can assist with the recovery of text messages, including those that may be deleted by the user, and should be consulted for cases that require forensically sound methods and software with the capability of having the most success in recovering deleted text messages. There are often situations where deleted messages can be retrieved, and in many cases, they cannot be recovered and simply no longer exist for various reasons. If a deleted text message is important and relevant to the case, it is worth attempting to recover the message(s) and determine if the messages in question still exist.