← Back to Labs

Deleted Data: Where It Hides

Trace a deleted message through filesystem pointers, NAND flash pages, SQLite freelists, and forensic extraction

App LayerSQLite DBFilesystemNAND Flashstep 1 of 8
Step 1 / 8Delete Message (Pointer Removed)

When you delete a message in a chat app, the app simply removes its pointer to the data. Think of it like removing a book from a library catalogue: the book is still on the shelf, but nobody knows where to find it. The message content is still physically present in storage.

Arrow keys · R to reset

Tap dots to jump

Read the full article →Take the quiz →