Are the Messages Being Automatically Deleted?

iOS 8 introduced the ability to automatically delete messages from the Messages app. So, how would an examiner know whether messages on a suspect's iPhone or iPad were deleted automatically by the app?

 

Users change the setting on an iOS device by navigating to Settings ➔ Messages ➔ Keep Messages, then choosing one of the available time periods.

 

messages-auto-deleted-1messages-auto-deleted-2messages-auto-deleted-3messages-auto-deleted-4

 

When the setting is changed, any message on the device that falls outside the parameters set will automatically be deleted.

 

Examiners can look at /mobile/Library/Preferences/com.apple.MobileSMS.plist on an iOS device, paying special attention to the key "KeepMessageForDays." The value for this key will reflect the number of days for which messages are being saved before automatic deletion.
messages-auto-deleted-5

 

And now you know.

Carpe Datum!

Leave a Reply

Sorry, you must be logged in to post a comment.