Mobile evidence guidance
What evidence remains after a messaging application is deleted?
Deletion may remove the primary database but leave media, notifications, backups, system records, installation history, linked-computer artefacts and counterpart evidence. The result is application and device specific.
Potential evidence sources
Where relevant records may exist.
- Application containers and residual files
- Media folders and thumbnails
- Notification databases
- Installation and usage records
- Cloud or local backups
- Linked and counterpart devices
Decision factors
What materially changes the prospects.
- 01Whether the app was deleted or only logged out
- 02Operating system and cleanup behaviour
- 03Time and use since deletion
- 04External media storage
- 05Backup and synchronisation settings
Evidential limitations
What must not be overstated.
Reinstallation may overwrite or replace evidence
Application presence does not prove particular message content
Residual traces may be incomplete and require cautious interpretation
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
