Think deleted text messages are gone forever? Think again

A former federal prosecutor and cybercrime expert tells how IT departments can retrieve text messages that the user thought were deleted months or even years ago. As more litigation and investigations turn on the content of texts, every CIO needs to know how to find the smoking gun.

1 2 Page 2
Page 2 of 2

Second, secure the laptop or workstations that may have been used to back up the phone.

Deleted Text Messages

Third, you may need to call computer forensics expert who is well-versed in a variety of different phones and forensic tools. Unlike a hard drive, laptop or desktop where you have three flavors -- Apple, Windows and Unix or Linux -- cellphones have maybe 150 flavors.

Fourth, make sure you note the make and model of the phone, because that will dictate whether or not the forensics expert can handle it and how difficult to job might be. You'll also want to provide information about specific dates, addresses and phone numbers, which will help the forensics expert wade through the thousands of text messages.

[Related: How to Craft the Best BYOD Policy]

One thing you should be ready for with cost estimates from a mobile forensics company is that you'll probably pay as much, if not a little more, than you would for the analysis of a [PC] hard drive. With cell phones, we'll often go at them with two or three different tools. How far back can you go?

Luehr: We just had a case last week where we were able to harvest and recover 8,000 text messages. They covered between 12 and 15 months of activity; a year's worth of text messages is quite normal to see. The phone had been recently wiped and reformatted, but we found a thousand text messages within the backup. Were they all stored on the phone?

Luehr: So we talked about the database, where there are active texts you can pull up and deleted texts using forensic tools. Depending on the phone, you can also perhaps go down and get information off the physical layer of the phone, much like making a forensic image of a hard drive.

In the unallocated space that exists in the background, we will be able to recover snippets of text messages or entire text messages if they still happen to linger there. With cell phones like the more modern iPhone, because of the encryption algorithms they use, the background information is all scrambled.

If the phone was backed up any place, a backup of those text messages can exist on the hard drive in both active and deleted form. What about data from the phone companies?

Luehr: I haven't heard of any investigators going to the phone company for text messages. As I understand it, the most a phone company has is the meta data. Might even be at a higher level, such as X number of messages were passed, maybe the to and from, but probably not the content itself.

[Related: The BYOD Mobile Security Threat Is Real]

It's important to have access to the device and the laptop backup. With BYOD, it underscores the importance of having a thorough exit strategy whenever an employee leaves. If you think text messages are in play, you need to have some access to that device. If you didn't have access to the BYOD phone, can you search for deleted text messages on the corporate-owned laptop used as a backup?

Luehr: Theoretically, you could but that's a dangerous proposition from a legal and ethical perspective. If it's truly a person's personal device and they have a reasonable expectation of privacy, you may be crossing a line when looking at that personal information, especially if it's just in a backup format.

[Related: How BYOD Puts Everyone at Legal Risk] Can you get deleted messages from Whatsapp, iMessage, Snapchat and others?

Luehr: We had a case that involved a conversation between different players in the game Words With Friends. The messages sent back and forth within that gaming environment ended up being relevant to the litigation. It depends on how the software is built. Many of them that have a messaging feature will have within their structure, either on the server or in the app itself, some type of database -- a lot of them use a SQL-like database. If that database exists, then it's very similar to retrieving information from the mobile phone's messaging system.

[Related: Mobile Device Management Lets You Track Your Teens]

Increasingly, we have more cases involving mobile devices and apps. I've learned that apps really run the continuum. One operates almost like the old terminal and mainframe type of environment, where the app is really a very thin client and doesn't have much substance. Other apps are storing a substantial amount of information on the phone. It's really just a programming choice, and we see it both ways.

Tom Kaneshige covers Apple, BYOD and Consumerization of IT for Follow Tom on Twitter @kaneshige. Follow everything from on Twitter @CIOonline, Facebook, Google + and LinkedIn. Email Tom at

Copyright © 2014 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
FREE Download: Get the Spring 2019 digital issue of CIO magazine!