Friday, August 9, 2019

WhatsApp - Images and Messages - An overview

WhatsApp - Images and Messages - An overview

So many good questions from my colleagues. E.g.
- What happens if someone deletes a message, can we recover it?
- What happens when a picture is sent and than deleted?
- If a picture is stored in the WhatsApp Media Image folder, what does this mean? Was it sent? Was it received? Was it created by the device within WhatsApp?

I decided to test this stuff with my test smartphone and write my results down here. This post shall give a first overview. I want to take deeper look especially on the recovery of deleted messages in the future.

The environment

My test device and the used versions:

Samsung Galaxy S6 (SM-G920F)
Android 7
WhatsApp Version 2.19.150

The pathes:

The media file path of WhatsApp on the test device is:


The path for the images is:
/sdcard/WhatsApp/Media/WhatsApp Images


Before I start with the images and messages one short sentence about the timestamps of the messages and the images:

Messages: The timestamps of the messages are in UTC and the time comes from the server side. It is not important what time the device has. And, you cannot use WhatsApp if your time is not synced with the world time. At least I was not able to do it.

Images: The timestamps of the images in the filesystem are mostly close to their sending/receiving time. This is because normally when you receive an image it is automatically stored in that moment to the filesystem. Same when sending/taking an image with WhatsApp.
Restriction: If the device is not in a local network and automatic download is not activated the timestamp of the image could be different. But I've not tested it yet!


What does it mean if an image is only stored in the subfolder Sent in the WhatsApp Image folder?
The path:
/sdcard/WhatsApp/Media/WhatsApp Images/Sent

The image was sent via WhatsApp but not created via WhatsApp.   

What does it mean if an image is stored in both folders, the subfolder Sent and the WhatsApp Images folder (same hash values/content)?
The pathes:
/sdcard/WhatsApp/Media/WhatsApp Images/Sent
/sdcard/WhatsApp/Media/WhatsApp Images

The image was created/taken directly in the WhatsApp Application and than sent via WhatsApp.

What does it mean if an image is only stored in the WhatsApp Images folder?

The path:
/sdcard/WhatsApp/Media/WhatsApp Images

The image was received by WhatsApp. The image and the thread that contains it must not be actively viewed by the user.
Restriction: I've tested this with W-LAN activated, so the image is automatically downloaded.
It is possible that the user forwarded the picture. It would than not be duplicated into the Sent folder.

What happens if the user deletes the last message for everyone that includes an image?

On the phone that received the image the image will be deleted in the filesystem and the message will be deleted in the database.

On the phone of the sending person the image in the Sent folder will be deleted, the image in the media folder (if the image was created by WhatsApp) will remain. The message will be deleted in the database.


The messages was deleted by the sender for everyone. You get a message on your phone in WhatsApp like the one in the following picture.

In the database the message content is empty.
The sender has something like in the following image on his phone: