Self-Destructive Messages on the Android Platform: A Secondary Data-Based Study of Forensic Recovery and Cybersecurity Applications

Abstract

Self-destructive messaging removes visible content after a set time or viewing event, but application-level expiry does not necessarily result in storage-level erasure. This work proposes a secondary evidence-based reproducible framework for comparing the residual artefacts of self-destructive messaging on Android. The evidence base was updated through August 2026 and presented as a residual-artefact taxonomy (primary database, journal/WAL, media cache, notification, log/telemetry, backup, and volatile memory), which was then applied to six of the most frequently studied applications: Signal, Telegram, WhatsApp, Snapchat, Wickr Me, and Confide. A total of 42 application-artefact cells were coded from the literature reviewed. Based on this matrix a Residual-Artefact Persistence Index (RAPI) is calculated. RAPI is a literature-based evidence-synthesis score that categorically quantifies the frequency of reporting residual artefacts in the reviewed studies and is NOT a probability that a given device will have successful forensic recovery. To interpret the rank in relation to the coding assumptions, baseline RAPI values and a leave-one-category-out sensitivity analysis are reported as well as two alternative weighting schemes. A lower score may therefore reflect a less extensive published evidence base rather than necessarily indicating more robust secure deletion – this is highlighted for Confide. The paper is a structured secondary synthesis and controlled replication on the current Android devices is still necessary, as no new experiments were carried out with the device. The contribution is a common artefact taxonomy, a 42-observation coding framework, a comparative analysis, as well as a set of clearly separated engineering recommendations for developers and investigators.