Deleted WhatsApp messages: the backup comes first.

Check the gallery first. If media saving was on, WhatsApp copied every photo and video into the phone's own gallery, and deleting a chat does not remove those copies. Then check the backup. In WhatsApp, open Settings, Chats, Chat backup. Android shows the last Google Drive backup; iPhone shows the last iCloud backup. If that backup was made before the deletion, uninstall WhatsApp once, reinstall it, sign in with the same number and accept Restore when it is offered. You get every chat up to that backup and nothing after it. This is a genuine do-it-yourself case, and you should try it before paying anyone. Before you do it, turn off automatic backup so tonight's run does not replace the copy that still has the chat.

Stop when the last backup was made after the deletion, or there is no backup. Put the phone in flight mode and stop using it. Every new message and every received photo writes into the same storage the old database sits in. Do not reinstall the app again. Do not install a recovery app from the store and run it on the phone: most write as they scan, many are junk, and some ask for your account. Do not factory reset, and do not let anyone flash the phone. Call, and tell us which platform it is and whether it still unlocks.

Android keeps your chats in one encrypted database, msgstore, in crypt14 or crypt15 form. The key lives on the phone or in your WhatsApp account, not in the file. WhatsApp also keeps dated local copies of that database for about a week. When the phone unlocks and the key can be read, we image what is there read-only and open each dated copy. A message deleted after one of those copies was made is often still in it. A message deleted before the oldest copy, or overwritten since, is not there, and we say so rather than scan for a week. Photos that were never saved to the gallery live in the same container and come back with the chat that held them.

iPhone is a different job. The chat database sits inside the app's own container, and the practical sources are an iCloud or computer backup and a working, unlocked handset. We work from those. Deep extraction from a dead or locked iPhone is not claimed here. The rule on our phone and tablet page is the same rule: Android depth when keys allow, iOS from backups and working devices.

Where keys are missing, money does not decrypt the media. You hear that at assessment, before any quote. When the messages are needed as evidence, say so when you call. The phone is then received under chain of custody, as described on digital forensics, and every step from imaging to export is recorded. Start with a case form or a phone call; the free assessment decides which path applies before any quote.

We do not run a cleanroom. Mechanical failures (clicking, non-spinning, head crash) are referred after free assessment. We will not open the drive on a bench and make it worse.