When these apps that you have don't live up
to your expectations, or we think they're encrypted,
but we find data at rest, what I would say is,
never trust the app.
If it claims it has zero data, it never
saves any data, verify that.
Go and verify.
Now, do I use these self-destructing apps
or these secure apps?
I absolutely do.
I understand, though, that data could be saved
in a database on my device.
If you don't want anything to ever be on your device,
just don't ever type a word on it.
Don't make a phone call on it because it's always
going to be stored somewhere.
Remember, every contact leaves a trace.
Are we going to be able to uncover it?
If an app says encryption keys are not stored locally,
dig in the file system.
If an app says that the database is secure,
what if it slips through QA and it's not secure?
Is there a write ahead log that's associated with it?
Is there a cache file that you can find?
If you have a rooted or jailbroken device,
you will always get more information than if you do not.