In the digital age, not all messages are meant to last. Ephemeral messaging tools – like WhatsApp, Signal, and Snapchat – are designed to disappear, offering users privacy and convenience. But for investigators, these platforms present a unique challenge: how do you preserve, verify, and interpret messages that were never meant to be permanent?
During our Behind the Screens webinar, Jim Vint, Managing Director at Secretariat, Christine Young, Partner at Herbert Smith Freehills Kramer, and Tim Smith, Head of Operations at Safecall explored the risks and realities of ephemeral messaging in workplace investigations.
What Are ephemeral tools?
Ephemeral messaging apps delete messages after a set time or once they’ve been read. As Jim explained:
“The benefit is enhanced privacy and reduced digital clutter. But for businesses, it poses serious compliance challenges.”
Popular platforms include:
- WhatsApp (with disappearing messages)
- Signal (known for strong encryption)
- Snapchat (messages vanish after viewing)
These tools are increasingly used for work-related conversations – often outside official channels.
Why ephemeral messaging complicates investigations
- No server backup
Many of these apps use peer-to-peer delivery, meaning messages exist only on the devices themselves. If deleted, they may be unrecoverable. - False sense of security
Encryption and disappearing features may lead users to believe their messages are immune to scrutiny – even when used for business purposes. - Risk of spoliation
Regulators are cracking down. Jim cited cases where:- Google faced sanctions for training employees to disable chat history.
- Amazon used Signal’s disappearing messages during a competition investigation.
- US grocery merger executives lost key texts due to device settings.
- Manipulation & selective disclosure
Christine shared examples where parties in investigations provided only partial chat histories – highlighting the need for full exports and forensic validation.
Can deleted messages be recovered?
Sometimes. Recovery depends on:
- Device settings
- App configurations
- Whether backups (e.g., iCloud) exist
But for apps like Signal and WhatsApp with disappearing features enabled, recovery is often impossible – especially if both parties delete messages.
What can employers do?
To manage the risks of ephemeral messaging:
- Update policies to prohibit or regulate use of disappearing messages for work
- Educate employees on the risks and responsibilities
- Engage forensic experts early to preserve and validate data
- Document processes to maintain chain of custody and legal defensibility
As Christine noted:
“Just because you can access data doesn’t mean you should. Investigations must be proportionate and respectful of privacy.”