What are disappearing messages?¶

Some messaging services allow content to expire automatically after a set period or after it is opened.

Evidential caution: that disappearing messages leave no evidence.

What this means¶

A disappearing-message feature changes how long content remains visible within the service. It may operate by conversation setting, message type, timer or view count.

The content may still exist on the sender’s device, recipient’s device, linked devices, backups, notification history or screenshots. Attachments may have been downloaded or saved separately.

Opening the message can matter. Some content disappears only after viewing. An investigator who opens it without a preservation plan may start a timer, create a read event or cause the content to vanish.

An offline linked device may hold a copy that has not yet received the expiry instruction. Reconnecting it may trigger synchronisation and remove the content.

Where content has expired, examine recipient copies, notifications, screenshots, downloads, backups and forensic artefacts.

In reporting, distinguish between a message configured to disappear and a message proven to have left no surviving record.

What to check or do next¶

• Record the service, account, device, visible timer, conversation settings and current message state before interacting. Photograph or capture the screen where lawful and appropriate, but preserve the source device and seek specialist advice where the content is volatile.

Evidential limits¶

The service may preserve metadata showing that a message was sent, delivered, opened or expired even if the provider cannot supply the readable content.

Do not assume the presence of disappearing messages proves criminal intent. They are ordinary privacy features used for many reasons. Their significance depends on the surrounding circumstances.