Deleted WhatsApp message is recovered by the police – 05/25/2023 – Power

The possibility of extracting deleted messages from applications such as WhatsApp on seized cell phones is still a challenge for police investigators, who point to restrictions on accessing data ranging from settings to device model.

In addition, applications have implemented changes in recent years that make conversations more secure, such as those messages that are automatically deleted.

The means that have been used by the Federal Police currently depend on the telephone user having, for example, an automatic backup. This form, according to investigators, leaves traces both in the cloud and on the device.

“Whoever wants to do something wrong, prevents it and takes the automatic backup”, says the president of the APCF (National Association of Federal Criminal Experts), Willy Hauffe.

According to him, it is possible to access the WhatsApp backup, for example, through Meta itself (owner of Facebook, WhatsApp and Instagram). “We officiate Meta, and Meta says ‘there’s a backup here and we send it'”, she says.

A recent example of access to cloud data is that of investigations into allies of former President Jair Bolsonaro (PL). A breach of secrecy ordered in 2021 allowed the PF to access the cloud in which all the conversations of Lieutenant Colonel Mauro Cid, Bolsonaro’s assistant, were stored.

From access to Cid’s conversations, the PF had at least five other authorizations from Moraes to break banking, telematics and tax secrecy of at least 13 people and one company – including three Bolsonaro advisors and two advisors to the former prime minister. – lady Michelle Bolsonaro.

Another way that has been used to recover information is to try to extract it from the device itself, but this also depends on the type of smartphone and the settings that the user makes in WhatsApp.

An example is if there is automatic document download on the machine. “Auto download physically saves [arquivos] in the cell phone drive and, even deleted, it is possible to recover it. As if it were the computer. The deleted data, as long as it is not overwritten, will be there”, says Hauffe.

It is more difficult to gain access to this data on more secure devices, especially Apple devices such as iPhones.

In general, experts have an easier time getting access to smartphones that use the Android operating system. This, however, also depends on the configuration of the device and the model used.

Computers using the web version of both WhatsApp and Telegram also facilitate message retrieval. You can search for application information that is saved on your computer.

Through the web version of Telegram, it was possible to hack, in 2019, the messages exchanged by members of Operation Lava Jato that were initially forwarded to The Intercept Brasil website and later seized by Operation Spoofing, of the Federal Police.

To recover physical data from cell phones, police agencies normally use tools such as Cellebrite, which is Israeli and has already helped recover deleted images from devices that were the basis of investigations of important cases.

One of these investigations is that of the boy Henry Borel, who died in March 2021 in Rio de Janeiro.

Former Carioca councilor Jairo Souza Santos Júnior, Dr. Jairinho, and his former companion Monique Medeiros will go to the popular jury for the death of Henry, who was four years old. The two are accused of triple murder.

Messages obtained by the police described repeated aggressions to which the boy was subjected by his stepfather, Jairinho, about a month before his death.

They also indicated that the mother, teacher Monique Medeiros, knew about the beatings and did not notify the police. The conversation was found under “prints” on Monique’s cell phone.