Deleted is not gone — but it is not all recoverable either

Most messaging, notes and call-log apps on both iOS and Android store their data in SQLite databases. SQLite’s own documentation on Write-Ahead Logging states that when a change is made, “the original content is preserved in the database file and the changes are appended into a separate WAL file” — meaning a deleted or edited row is not necessarily gone the instant an app says it is.

Whether the old content is then actually overwritten depends on a separate setting. SQLite’s own documentation for the secure_delete pragma states plainly: “When secure_delete is on, SQLite overwrites deleted content with zeros.” That setting is off by default in most apps that do not turn it on themselves — which is the specific, narrow mechanism behind the “deleted is not gone” idea, not a claim that every deleted message survives forever.

Privacy International’s 2018 report on UK police extraction found that MSAB markets its XRY Physical tool as able to access “system and deleted data,” and to use extra functionality to overcome security and encryption challenges. That is a vendor claim about a specific product, reported by a named researcher organisation — not a statement that any tool recovers everything a phone has ever held.

Whether a given tool can reach a given piece of already-deleted content on a given phone depends on the device state described in What a full extraction contains — off/BFU, AFU, or unlocked — and on whether the freelist space SQLite left behind has since been overwritten by ordinary use of the phone.

Separately from anything left on the phone itself, a copy of data may already exist in the cloud from before it was deleted locally. Apple states that with Advanced Data Protection enabled, “the number of data categories that use end-to-end encryption rises to 25 and includes your iCloud Backup, Photos, Notes and more.” For those 25 categories, Apple states: “Apple doesn’t have the encryption keys for these categories, and we can’t help you recover this data if you lose access to your account” — which cuts both ways: a synced copy can still exist in the account, but Apple itself states it cannot decrypt it. See Cloud and carrier for what that means for anyone other than the account holder.

None of the above adds up to “everything is recoverable.” It adds up to three narrower, sourced facts: SQLite keeps old content around briefly by design; overwriting it with zeros is an opt-in setting most apps leave off; and a cloud backup, where one exists and predates a deletion, is a separate copy governed by its own encryption. Whether any specific message on any specific phone is actually still retrievable is not something this page, or any general-purpose page, can answer.