The sudden disappearance of text from a chat marked “This message has been deleted” in WhatsApp on Android often means that the other party has used the clearing function, but the device’s notification system may retain a copy of the disappeared data until it is erased from memory.
Restoring access to hidden content depends on the version of your operating system and notification settings. Some methods work without installing third-party software, using only the system notification log, while others require deep analysis backup copies of the database. It is important to understand that instant recovery of text that has already disappeared from a chat without prior preparation may not occur if certain services have not been activated.
Using the Android notification log
The simplest and safest method of viewing deleted messages is available to users of Android 11 and newer. The operating system automatically saves the history of all incoming notifications, including the text of messages from instant messengers, even if the sender deleted them in the application. To use this function, you need to go to the device settings and find the section Notifications, and then select the item Notification log.
This list displays all alerts for the last 24 hours. If a message was deleted shortly after it was received, its text will most likely remain unchanged in this log. However, this method has a significant drawback: it only works if the notification managed to arrive on the lock screen or curtain before it was deleted. If the chat was open at the time of sending, the system may not create a log entry.
For users of older versions of Android, where there is no built-in log, you can use third-party notification history viewer applications. They work on a similar principle, requesting access to system logs. Installing such software requires careful attention to permissions, since the application gets access to all your incoming notifications, including confirmation codes from banks.
Recovery via local backups
Messenger WhatsApp by default, creates local copies of the message database every night at 02:00. These files are stored in the internal memory of the device or on the memory card in the folder Android/media/com.whatsapp/WhatsApp/Databases. If a message was deleted today and a backup was made last night, restoring a previous version of the database will return the deleted text.
The recovery process requires sequential steps. First, you need to remove the current messenger app from your device. Then, using a file manager, locate the database file with a date before the message was deleted (for example msgstore-2023-10-25.1.db.crypt14). This file needs to be renamed, removing the date from the name so that it becomes simple msgstore.db.crypt14.
After renaming the file, install the messenger again. When you first start it, the system will detect a local copy and offer to restore chat history from it. By agreeing to restore, you will return the state of the correspondence at the time the backup was created. It is worth considering that all messages received after the time this copy was created will be irretrievably lost.
☑️ Algorithm for restoring from the database
Third-party applications for reading notifications
There is a category of specialized applications, such as WAMR or Notisavethat intercept notifications in real time. The way they work is that they read the contents of an incoming notification before it is deleted by the sender and store it in their own secure storage. This allows you to read not only text, but also restore deleted media files if they have already been downloaded.
The effectiveness of such apps directly depends on the privacy settings of your device. If you hide the content of notifications on the lock screen or turn off the display of text in the curtain, the application will not be able to intercept the message. In addition, for correct operation, you must grant the app permission to read notifications and access storage for saving media.
⚠️ Attention: Using third-party applications to intercept notifications carries security risks. You provide access to all your personal data, including two-factor authentication codes and private correspondence. Use only proven apps with high ratings and reviews.
Database analysis via PC
For advanced users with database skills, there is a method for directly reading encryption files. The files .crypt contain the entire correspondence history, but they are encrypted with a unique key, which is stored in the Android system partition. Without root access, it is impossible to extract the key and decrypt the database directly on the computer.
However, if you have superuser rights, you can copy the key file key from the directory /data/data/com.whatsapp/files/key and the database file to your computer. There are special Python utilities and scripts that can decrypt these files if both components are present. This method allows you to download correspondence into a readable format HTML or CSV and find deleted entries manually.
This method is the most complex and requires a deep understanding of the Android file system. An error when working with system files or incorrect copying of the key can lead to the messenger stopping running on the device, requiring a complete reinstallation. Beginners are advised to limit themselves to methods with backup copies.
Technical details of encryption
WhatsApp uses the Signal end-to-end encryption protocol. Local databases are encrypted with the AES-256 algorithm. The encryption key is generated when you first install the application and is tied to a specific device and Google account.
Features of working with media files
Recovering deleted photos and videos has its own specifics. If the media file managed to be automatically uploaded to the device’s gallery before it was deleted in the chat, it will remain in the phone’s memory. Deleting a message in a chat often does not affect files already saved in the system, unless the option to delete from the device’s memory was selected.
Check the folder WhatsApp Images or WhatsApp Video in the gallery or file manager. Often photos deleted by the interlocutor are still there. If the file was also deleted from the storage, the chances of recovery are minimal, unless you use applications like WAMRthat cache incoming media in a hidden folder immediately after receiving a notification.
The table below compares the likelihood of recovering different types of content using different methods:
| Method | Text messages | Photos and Videos | Voice messages |
|---|---|---|---|
| Notification log | High | Low (thumbnails only) | No |
| Backup | High | High | High |
| Third-party applications | High | Average (depending on the load) | Average |
| Root access and database | Maximum | Maximum | Maximum |
To increase the chance of media recovery, enable automatic downloading of photos and videos in WhatsApp settings. Then the files will be saved in the phone’s memory even before the sender has time to delete them.
Prevention and privacy settings
In order not to depend on data recovery tricks, it is better to configure the system in advance so that information is stored more reliably. Regularly creating manual backups before important conversations or periodically archiving chats helps keep your history intact. An archived chat is protected from accidental deletion better than active correspondence.
It is also worth paying attention to the privacy settings of the messenger itself. Disabling the “Viewed” function will not prevent messages from being deleted, but will allow you to control the delivery status.
If you are using a corporate version of the messenger WhatsApp Business, recovery options may vary due to additional security policies imposed by the organization. In such cases, administrators can prohibit the creation of local copies or restrict access to the application file system.
⚠️ Attention: The settings interface and file location may vary depending on the smartphone model and shell version (MIUI, OneUI, ColorOS). Always check the folder paths in the file manager of your specific device.
The most reliable way to save important correspondence is to regularly create manual backups to the cloud or export the chat to a file, and not rely on restoring the deleted one.
Frequently asked questions
Is it possible to read deleted messages? message if the phone was turned off?
No, if the phone was turned off at the time the message was sent and deleted, the notification will not be sent to the device. Therefore, neither the notification history nor third-party applications will be able to capture the text. The message will appear only after turning on the phone, but in a deleted form.
Will the sender see that I have read the deleted message?
When using the notification log or third-party applications, the “Read” status (two blue checkmarks) is not sent to the sender, since you do not open the messenger application itself. You are reading text in a third-party interface or system log.
Do these methods work in WhatsApp on iPhone (iOS)?
No, the described methods are specific to Android. On iOS, the notification system is closed to third-party applications, and access to the file system and databases is impossible without jailbreak. On an iPhone, it is almost impossible to recover a deleted message.
Is it safe to install applications like WAMR?
It depends on trust in the developer. Such apps require full rights to read all your notifications. Theoretically, an attacker could intercept codes from banking applications. Use them only for reading everyday chats and disable access for important services in the phone settings.