The sudden disappearance of an important message in WhatsApp due to accidental deletion or the “delete for everyone” function often causes panic among owners of Android smartphones who urgently need to recover lost information.
Restoring correspondence is possible in several ways: from built-in backup functions to using third-party utilities and system logs. However, the effectiveness of each method directly depends on the settings of your device and the time that has passed since deletion. It is important to understand that permanent deletion it is still possible if you overwrite memory sectors with new data.
In this article we will take a detailed look at the technical aspects of data recovery, analyze working with database files and explain how to intercept the text of a message before it disappears from the screen. We will not use dubious spyware, but will focus on legal and safe methods available to any smartphone owner.
The mechanism of WhatsApp backups
The main tool for returning information is the automatic backup system. Messenger by default creates copies of chats daily at a certain time, usually at 2 am. This data is saved either in cloud storage Google Driveor in the local memory of the device in encrypted form.
To restore correspondence via the cloud, you need to delete the application and install it again. During the initial setup process installation wizard you will be prompted to find a backup copy. If you agree, all messages that existed at the time the backup was created will return to the chat. However, this method has a significant drawback: all messages received after the time the copy was created will be lost.
Local copies are stored in the internal memory of the phone along the path /Android/media/com.whatsapp/WhatsApp/Databases (on new versions of Android) or in the root of the folder /WhatsApp/Databases (on older versions). The files are named like msgstore-YYYY-MM-DD.1.db.crypt14. The number at the end indicates the encryption version, which changes with application updates.
⚠️ Attention: Before any manipulations with database files, it is strongly recommended to copy the current folder
Databasesto a safe place. An error when renaming files can lead to a complete loss of current correspondence.
To restore from a local copy, you need to rename the desired backup file to msgstore.db.crypt14 (or the current version of the crypto), having previously deleted or renamed the existing file with the same name. After reinstalling the application, the system will pick up exactly this file, ignoring cloud data if you turn off the Internet before starting.
☑️ Preparing to restore a backup
Reading messages through notification history
The easiest and fastest way to find out the contents of a deleted message is to use the “History” function notifications" built into modern versions Android (starting from version 11). This system feature saves the text of all incoming notifications, even if they were deleted by the sender before you opened the chat.
To activate this feature, go to Settings → Notifications → Notification history and turn on the switch. Now, if the interlocutor deletes the message, its text will remain in this system log. You can read it by simply opening the appropriate section of the settings, without having to restore the entire chat.
This method only works for text messages and only if the notification has already arrived on the device. If you were inside the chat when the message was received and deleted, a notification will not be generated and nothing will appear in the history. Also, the method is not suitable for media files.
On some shells, such as MIUI or OneUI, the notification history may be called “Notification History” or located in the advanced settings of the “Notifications and Status Bar” block.
There are also third-party applications, such as Notification History Logthat duplicate this function on older versions of Android. They work on the principle of intercepting system notifications and storing them in their own database. Using such utilities requires special permissions to access notifications.
Recovering media files through a file manager
Text messages are easier to delete than media files. When you or someone deletes a photo, video, or voice message from a chat, the file itself often remains in the device's memory unless the delete option for all devices has been selected to clear the cache. The phone's gallery stops displaying the file because the entry about it in the media database is deleted, but the data is physically on the disk.
To search for lost files, use the built-in file manager or third-party solutions like Files by Google. Go to directory /Android/media/com.whatsapp/WhatsApp/Media. Here the files are sorted into folders: WhatsApp Images, WhatsApp Video, WhatsApp Audio. Pay attention to the folder Sent — files that you sent are stored there, and Private — for hidden media.
Sometimes deleted images can be found in the folder .Trash or “Trash” inside the gallery, if such a function is activated on your smartphone. Files are usually stored there for 30 days before being permanently erased. This applies not only to WhatsApp, but also to any other deleted media.
| File type | Extension | Storage folder | Recovery option |
|---|---|---|---|
| Image | .jpg, .png | WhatsApp Images | High |
| Video | .mp4, .3gp | WhatsApp Video | Medium |
| Audio | .opus, .mp3 | WhatsApp Audio | High |
| Document | .pdf, .doc | WhatsApp Documents | Depends on cache |
If the file is not displayed in the gallery, try changing its extension or opening it through a third-party player. Sometimes a file's metadata is damaged when deleted from a chat, but the content remains readable by specialized software.
Using special detector applications
There are a number of applications on the market created specifically for tracking deleted messages. The most popular of them is WAMR. The principle of their operation is based on monitoring notifications and automatically saving content the moment it appears on the lock screen.
Such apps act as interceptors. When a WhatsApp notification arrives, the app copies the text and, if possible, downloads the media file before it is deleted by the sender. This allows you to read messages that were deleted immediately after being sent (“deleted for everyone”).
⚠️ Warning: Detector apps require full access to your notifications. This means that they can read the contents of messages from banks, social networks and other personal communications. Use them with caution.
The effectiveness of such utilities is reduced if you have disabled notifications for WhatsApp or if the message arrived while you were actively using the chat. In addition, they cannot recover messages deleted before installing the detector itself.
Why does WAMR not see some messages?
The application cannot recover a message if you turned off notifications for WhatsApp, if the message was deleted before installing WAMR, or if the chat was open when the message arrived (since the notification did not appear). Also, media files are not saved when the Internet is poor.
Professional data recovery (Root access)
For the most difficult cases, when neither backups nor notifications helped, there are deep memory scanning methods. They require root access (superuser rights) on the device. Without them, access to the system partitions where deleted fragments of databases are stored is closed.
Using utilities like Dr.Fone, Tenorshare UltData or console tools like sqlite3 you can try to find the “tails” of deleted records in the database file. When you delete a message from the SQLite database, it is not physically erased immediately, but is marked as free space. Until the database is reassembled (vacuumed), this data can be retrieved.
sqlite3 msgstore.db "SELECT * FROM messages WHERE deleted = 0;"However, this method is extremely difficult for the average user. Incorrect actions may damage the file system. In addition, modern versions of Android use disk encryption, which makes reading raw data without unlocking and keys almost impossible.
Root access gives the maximum chance of recovery, but voids the device warranty and can disrupt the operation of banking applications.
Preventing data loss and privacy settings
The best way to deal with loss of information is the correct configuration of the system in advance. Make sure that in the WhatsApp settings in the section Chats → Chat backup the frequency is set to “Daily”. Also check if uploading media files to the gallery is enabled.
For critical conversations, you can use the Pin Chat feature so you don't accidentally delete it when clearing your conversation list. Make manual copies regularly before important events or system updates.
Remember the Disappearing Messages feature. If it is enabled in a chat, messages are deleted automatically after a specified time interval. It is almost impossible to restore them using standard methods, since deletion is planned at the protocol level.
⚠️ Attention: The WhatsApp settings interface and file paths may change with updates to the application and the Android operating system. Always check the current menus in your software version.
Frequently asked questions (FAQ)
Can I read a deleted message if I did not make a backup copy?
Yes, this is possible through the Android notification history or using detector applications (for example, WAMR), if the message managed to arrive in in the form of a push notification. You can also try to find media files in the phone folders.
Will the other person see that I have read the deleted message?
If you read the message through the notification history or detector application without opening the WhatsApp chat itself, the “Read” status (two blue checkmarks) will not be sent to the sender. However, if you open the chat, the status will be updated.
Are voice messages restored after deletion?
Voice messages are more difficult to recover than text messages. They can be found in the folder WhatsApp/Media/WhatsApp Audio or WhatsApp/Media/WhatsApp Voice Notesif the file has not been overwritten. Detector applications can also intercept them upon receipt.
Is it safe to use data recovery apps?
Using trusted apps on a PC is relatively safe. However, installing unknown APK files on your phone with a request for superuser rights carries the risk of leaking personal data and infecting the device with malware.
What to do if new messages are missing after recovery?
This is standard behavior when rolling back to an old backup. The database is completely replaced to the state of the moment of backup. To avoid this, you need to make new copies more often or use recovery methods that do not affect the main database (for example, through notifications).