Disappearing messages can reduce the amount of conversation history retained on participating devices. They do not guarantee that every copy of a message has disappeared, and a timer is not a forensic sanitization certificate.
The useful question is not whether deletion is “real” or “fake.” It is which copy is deleted, from which storage location, under which assumptions? An app's visible chat, its local database, a downloaded attachment and a recipient's screenshot are different copies.
What a disappearing-message timer can do
A timer tells cooperating software when to remove content according to the product's rules. Those rules can differ: the clock may start on sending or reading, a setting may apply only to new messages, and linked devices may handle delayed delivery separately.
Signal's disappearing-message guidance explicitly warns that the feature is not a defense against a recipient who wants to retain a record. That limitation applies regardless of how carefully local deletion is implemented.
A recipient can photograph a screen, copy a passage or save a file before expiry. Malware with access to plaintext can do the same without waiting for a person to take a screenshot.
Why storage deletion is more complicated than removing a bubble
Deleting a database record or file need not immediately overwrite every physical location that once held it. Databases, temporary files, backups and flash storage management can complicate removal. However, that does not establish that every deleted message in every modern phone is easily recoverable.
Recoverability depends on the app, operating system, storage encryption, key availability, device state and the attacker's capabilities. Claims about a particular app require evidence from that app and version, not a general statement about SQLite or flash memory.
What cryptographic erasure adds
Cryptographic erasure aims to make encrypted data inaccessible by sanitizing the keys needed to decrypt it. NIST discusses this approach in its current SP 800-88 Revision 2 media-sanitization guidance.
For a messaging design, its usefulness depends on several conditions:
- The target content was encrypted appropriately before being stored.
- The deleted key is actually necessary to recover that content.
- No surviving key, backup or retained derivation state can reconstruct it.
- All relevant key copies are addressed, not just one variable in memory.
- Plaintext copies and independent recipient copies are handled separately.
Per-message or per-file keys can support fine-grained retention policies. Their existence alone does not prove secure erasure. Deleting an attachment key while retaining it inside an accessible historical message may leave a recovery path.
Four copies that need different controls
| Copy | What to check |
|---|---|
| Message inside the app | Timer behavior, local retention and linked-device handling |
| Downloaded photo or document | Gallery, downloads, exports and other apps' storage |
| Backup or transferred history | Whether expired content or usable keys remain recoverable |
| Recipient's own copy | Trust and sharing agreement; remote deletion cannot guarantee recall |
Full-device encryption remains useful even when an app uses separate content keys. These controls protect different situations; neither should be dismissed as irrelevant.
How to use disappearing messages realistically
Choose a retention period appropriate to the conversation and make sure participants understand it. Check whether saving media creates a separate copy. Review backup behavior and what happens when an offline linked device reconnects.
If you need to dispose of a device, follow the operating-system or organization's sanitization procedure. Do not treat a chat timer as a substitute for device disposal controls.
For Livara, the security page describes per-file keys and the threat model identifies recipient and endpoint exposure. Those facts do not, by themselves, demonstrate per-message cryptographic erasure or forensic deletion across every device. This article makes no such implementation claim.
Disappearing messages are most useful as a retention control. Treat irreversible deletion as a stronger, separately evidenced claim.
