What happens when a user deletes a message?¶

A user may delete a message from a conversation and assume it has gone.

Evidential caution: that deletion removes every copy and every record of the communication.

What this means¶

Deletion can mean different things. It may remove the message only from the user’s own view. It may request removal from other participants’ views. It may clear local application data while leaving backups, notifications or linked devices unchanged.

The other participant may still have the message. A screenshot, export, forwarded copy, quoted reply or attachment may survive. The content may also remain in device storage, backups or forensic artefacts even if it is no longer visible in the application.

Providers may retain metadata showing that an event occurred, even where readable content is unavailable. Organisational systems may also preserve audit, retention or compliance copies.

Deletion can alter the evidence. Removing a message may create a system notice, change the conversation sequence or trigger synchronisation across devices.

In reporting, distinguish between content no longer visible and content proven to have been destroyed.

What to check or do next¶

• Preserve the current state before interacting further. Record deletion markers, gaps, timestamps, surrounding messages and the identities of all participants and devices.
• Ask what type of deletion was used and when. “Delete for me” and “delete for everyone” are not equivalent, and service behaviour may vary.
• If recovery is important, seek specialist support before reconnecting offline devices, restoring backups or repeatedly opening the application.

Evidential limits¶

Do not assume the person who owned the account performed the deletion. A linked device, shared user or compromised session may have done so.