Digital Forensics Dispatch

Mobile Forensics Data: WhatsApp Working on Update to Ephemeral Messaging

December 15, 2022

Mashable’s Stan Schroeder recently reported that WhatsApp, the ever-popular third-party messaging platform with end-to-end encryption, is working on an update to its ephemeral messaging. Ephemeral messages are messages that disappear after opening.

Many third-party messaging platforms offer this as a privacy feature so that messages cannot be read by other people after they have been sent. One of the most popular applications for ephemeral messages is Snapchat, where a user can send a message, photo, or video and once it is viewed it disappears and cannot be seen again. The exception for Snapchat is that when a message is sent via a direct message, both users have the option to save messages in the chat thread. Additionally, screenshots or screen recordings can be used to capture the ephemeral data.

WhatsApp has had ephemeral messaging since November of 2020. These messages would disappear after 7 days, but the feature was later expanded allowing “for messages that disappear after 24 hours or 90 days” writes Schroeder.

“Now, according to WABetaInfo, the company is working on an extreme version of the disappearing message – a message that can only be viewed once before it disappears, both for the sender and the recipient” Schroeder states.

In the world of digital forensics, ephemeral or disappearing messages is nothing new. Several applications support these features. While these features often can hinder finding messages on a device with the feature enabled, sometimes other data may exist on the phone or with the application developer that can be useful.

An interesting feature that Schroeder mentions is that with WhatsApp, photos and videos have already had this feature in place. With the disappearing photos and videos, Schroeder writes “[when] you send a view-once photo or video, the person on the other end cannot take a screenshot of it; presumably, the same functionality will be enabled for view-once messages too.”

While the features mentioned are still currently in the beta testing phase, it will be interesting to see how this feature, if fully implemented, affects the WhatsApp data examiners can find on a mobile device.

Email:    Phone: 703.359.0700
Digital Forensics/Cybersecurity/Information Technology
https://senseient.com/services/digital-forensic