Many Android smartphone users are faced with a situation where they accidentally delete an important dialogue or media file in the messenger, and then frantically search for a way to get them back. The first and most logical question that arises at this moment is: “Where did this information physically disappear?” The answer to this is not as simple as it might seem at first glance, since the data storage architecture in Android has undergone significant changes in recent years.
The Android system logic is designed in such a way that deleting a file from the application user interface WhatsApp does not mean instantly erasing it from the physical storage medium. The operating system only marks the space occupied by the data as free for writing, but the bytes themselves can remain on the disk until they are overwritten by new information. Understanding how exactly file system processes these requests is the key to successful recovery.
However, modern versions of Android, starting with the eleventh, have implemented strict access restrictions to system folders, which has significantly complicated direct access to message archives through file managers. If previously the user could easily find the folder WhatsApp at the root of the internal memory, now the paths have become deeper and more intricate. In this article, we will look in detail at where exactly your deleted data is hidden and what real ways to save it exist.
Local databases: hidden memory reserve
The main storage of correspondence history on Android devices is local databases. They are created automatically every night at 2 a.m. if the corresponding function is enabled in the messenger settings. These files have an extension .db.crypt (numbers may vary, for example, crypt14, crypt15), which means a high degree of encryption. It is these files that are the “holy grail” for those who want to restore correspondence.
The location of these files depends on the version of the operating system of your smartphone. On older versions of Android (up to and including 10), the path was simple and clear: Internal memory/WhatsApp/Databases. Here were files with names like msgstore-2023-10-25.1.db.crypt14, where the date in the name indicated the time the backup was created. You could find them even without root access, simply by connecting the phone to a PC.
The situation changed dramatically with the release of Android 11 and newer. Google has implemented a "Scoped Storage" policy that isolates app data from each other for the sake of security. Now the path to local backups looks much more complicated: Android/media/com.whatsapp/WhatsApp/Databases or Android/data/com.whatsapp/files/Databases. Access to the folder Android/data is often limited by standard file managers, which requires the use of specialized utilities.
⚠️ Attention: Database files are encrypted with a unique key tied to your account and device. Simply copying the file
.db.cryptto another phone and renaming it will not work - the messenger will not be able to read it without the corresponding encryption key, which is stored in the system partition.
It is important to understand that local copies are stored in the amount of 7 pieces (for the last 7 days). When a new copy is created, the oldest existing one is deleted. Thus, if you deleted a message a week ago, the chances of finding it in the local archive tend to zero, since the file with that date has already been overwritten or deleted by the rotation system.
Technical details of encryption
Encryption keys for databases are stored in the hidden system partition /data/data/com.whatsapp/files/key. Without root access, it is impossible to obtain this key, so manually transferring the database between different devices or after resetting to factory settings (without using Google Drive) often leads to the loss of the ability to decrypt the history.
Google Drive cloud storage: digital footprint on the network
The second place where your deleted messages can be located is a cloud service Google Drive. Unlike local copies, which are stored as files on the device, a Google Drive backup is a hidden object that is not visible to the user in the standard cloud interface. You can't just open the WhatsApp folder in Drive and download a file from there.
The mechanism of cloud backup differs from local backup in that it is not so clearly tied to specific dates in the file name. When you reinstall an application or change your phone, WhatsApp it finds the latest available version of the backup linked to your Google account and offers to restore it. This is the most reliable, but also the most “disposable” way to save data.
It is worth considering that cloud copies do not take up space in your Google Drive quota limit (although media files, if downloading is enabled, may take up space). However, if you deleted a message and it managed to sync with the cloud before deleting, then when you restore it from the cloud, the message will return. But if the deletion occurred a long time ago, and since then a new backup has been made, then the deleted message will be overwritten in the cloud by a new version of the database without this message.
There is an important nuance: restoring from a cloud copy is only possible with a clean installation of the application. You cannot "roll back" chat within a running application by selecting a restore point. The process always requires deleting the current state of the messenger and loading the archive from scratch.
Folder structure and media files: where to look for photos and videos
If with text messages everything is relatively clear thanks to databases, then with media files (photos, videos, voice messages) the situation is different. They are not stored inside the database .db, but are stored as separate files in special directories. When you delete a photo from a chat, it is deleted from both the gallery and the messenger folder.
On modern Android smartphones, the paths to media files have also been changed. Previously, everything was in a folder WhatsApp/Media. Now, following the new structure, the files are distributed by content type within the directory Android/media/com.whatsapp/WhatsApp/Media. Here you can find subfolders:
- 📁 WhatsApp Images — all received and sent images, as well as thumbnails are stored here.
- 🎥 WhatsApp Video — directory for videos, which often take up the most space.
- 🎙️ WhatsApp Audio — folder for voice messages and sent music files.
- 📄 WhatsApp Documents — storage location for all documents transferred to chats.
The peculiarity of deleting files in Android is that when deleted from the gallery or explorer, the file often ends up in the system trash ("Recently Deleted"), where it is stored for 30 days. However, if the deletion occurred within the application itself WhatsApp (the "Delete from me" function), the file can be permanently erased, bypassing the recycle bin, especially on older versions of the OS.
To search for deleted media files, you can try using the "Show hidden files" function in the file manager. Sometimes remnants (remains) of files can be stored in temporary folders, for example, in .Statuses (statuses) or application cache, although the chances of finding a high-quality copy of the deleted photo there are low.
Use specialized duplicate and deleted file scanner applications, such as DiskDigger, which can scan internal memory for "orphaned" files that have no reference in the file system, but have not yet been overwritten by new data.
The influence of the Android version on access to archives
The operating system version is critical factor that determines whether you can even see the files where messages are deleted. The differences between Android 9, 11 and 14 are enormous in terms of access rights and directory structure.
| Android version | Database path | Access via file manager | Security features |
|---|---|---|---|
| Android 9 and below | /WhatsApp/Databases/ |
Full access | Minimum restrictions, files are visible immediately |
| Android 10 | /WhatsApp/Databases/ or /Android/data/... |
Limited access | Start of implementation of Scoped Storage |
| Android 11 - 13 | /Android/media/com.whatsapp/WhatsApp/Databases/ |
Specialist required. access | The data folder is hidden, a special permission request is required |
| Android 14+ | /Android/media/com.whatsapp/WhatsApp/Databases/ |
Strict access | Additional checks of the application signature upon access |
Users of new versions of Android to access the folder Android/data often have to resort to tricks: either use manufacturer's built-in file manager (for example, "My Files" on Samsung), or install third-party explorers that can request special permissions through the system API.
For example, a popular file manager Total Commander or Files by Google may have limited access, while Material Files or Solid Explorer often do a better job of asking for read permissions on system directories. Without these tools, searching for deleted messages turns into a dead-end task.
The newer the Android version, the more difficult it is to gain direct access to the application's file system without root access, which shifts the focus of data recovery from manually copying files to using cloud backups.
Recovery methods: from simple to complex
If you have figured out where the messages go and found the corresponding files, the problem arises the question of their restoration. There are several proven methods, the effectiveness of which varies depending on the specific situation.
The simplest and most reliable method is to reinstall the application. To do this, you need to uninstall WhatsApp, then reinstall it from Google Play Market. On first launch, after confirming your phone number, the system will detect a local or cloud backup. You will be prompted to click the "Recover" button.
⚠️ Warning: When restoring from a local copy (file from an SD card or internal memory), it is extremely important that the file name matches the expected format. The last backup file should be named
msgstore.db.cryptXX(no date in the name). If you want to restore a copy of the day before yesterday, you need to rename the file with the date removed from the name and place it in the database folder.
A more complex method involves manual file manipulation. You need to:
- 📂 Find the backup file with the desired date in the folder
Databases. - 📝 Rename the current file
msgstore.db.cryptXX(for example, add ._old) so as not to lose fresh data. - 🔄 Rename the selected archive with date in
msgstore.db.cryptXX. - 📲 Reinstall the messenger and select recovery.
There are also third-party apps for PCs that promise data recovery directly from the phone. They scan memory looking for deleted sectors. However, their effectiveness on modern Android smartphones with default encryption (FDE/FBE) is extremely low. Without root access, such apps are often useless.
☑️ Algorithm of actions before recovery
Frequent errors and encryption nuances
When trying to recover deleted messages, users often make mistakes that lead to the final loss of data. One of the most common is trying to open a database file on a computer. As already mentioned, files .crypt cannot simply be opened with Notepad or Excel. They look like a set of meaningless characters.
Another mistake is ignoring the time the copy was created. If you deleted a message this morning, and the last automatic copy was created today at 2 a.m. (before deletion), then the message is not yet in this copy (or it is there if it was deleted after 2 a.m., but then yesterday’s copy is needed). Confusion in dates leads to the installation of an “empty” or old version of history.
It is also worth mentioning the problem of incompatibility of encryption versions. If you try to take a file crypt14 from an old phone and transfer it to a new one with a version WhatsAppthat only supports crypt15, the recovery may not work. Encryption keys are generated during installation and stored in a secure area.
Don't forget that the "Remove for everyone" function works differently than the "Remove for me" function. If you used global deletion, the message is erased on the server and from the other party. The local copy on your phone will also be updated the next time you sync, and traces of the message will disappear from the archives faster.
The Myth of the .nomedia Folder
Many users create a .nomedia file in WhatsApp folders to hide pictures from the gallery. This does not affect the backup operation, but it can be confusing when searching for files, since standard galleries stop indexing the contents of the folder, although the physical files remain in place.
Preventing future data loss
In order not to wonder where the messages disappeared and how to get them back, it is better to set up a data security system in advance. Regularity is the main enemy of information loss. Make sure that in the settings Chats → Backup of chats the frequency is set to "Daily".
In addition, it makes sense to periodically make manual copies of important conversations. This can be done through the settings menu by clicking the "Back up" button manually before making important changes or wiping your phone. You can also export individual chats: go to contact information, scroll down and select "Export chat." You will receive a text file .txt with your entire history, which you can save in a safe place.
Using Google Photos to automatically download media from WhatsApp is also a great strategy. Even if the messages are deleted, photos and videos will remain in the Google cloud, since they are copied regardless of the text history of the correspondence.
Remember that data on digital media is not eternal. Flash memory tends to degrade, and software glitches happen even on top-end smartphones. Having several copies of important data (local + cloud + export to PC) is the only guarantee that valuable information will not be lost forever.
Is it possible to restore messages if the phone has been reset to factory settings?
If you did not make a backup copy in Google Drive before resetting, then it is almost impossible to restore messages. A reset deletes the encryption keys and the database files themselves. Local files are also destroyed. The only chance is if the copy managed to fly to the cloud automatically before the reset.
Where are deleted messages stored if an SD card was used?
On older versions of Android and when setting up storage on an SD card, the files could be located along the path /sdcard/WhatsApp/Databases. However, modern versions of WhatsApp force databases to be stored in internal memory even when a card is present, due to Android security limitations. The card can only be used for media files.
How long are deleted messages stored in the database?
The latest 7 daily copies are stored locally on the device. Google Drive cloud stores only one latest version of the backup. Old versions are not saved in the cloud, they are replaced with new ones every time the archive is updated.
Will apps for data recovery from a PC help?
Most of these apps are effective only on very old Android (up to version 6-7) or require root access. On modern devices with disk encryption enabled, the chances of finding deleted messages through third-party software without backup are extremely low.