Once that button is turned on for Messages, there is no telling how much time you have to recover deleted SMS messages. On my tested device, the purge seemed to be as quick as me flipping the switch and dumping the device. However, a student in Vegas proved this to not be true. For this test, he enabled the Messages to be synced to iCloud, deleted several messages on Sept. 11, 2019, then dumped his device using Method 1 and Method 2 in Physical Analyzer, which is the old way of acquiring iOS devices. Currently, this would be done with an Advanced Logical extraction on UFED.  Notice that all of the deleted SMS messages persisted. This blew my mind.

The next morning, I asked him to send a few more messages and delete them and dump his phone again. Guess what – all of the messages from Sept 11, 2019, were gone and only newly deleted messages were present! Clearly, there is a time frame in which the purging occurs. Could it be poor Wi-Fi? Poor cell service? Storage space? Sure, in smartphone forensics anything is possible. If this isn’t reason enough for you to dump the phone as quickly as possible what is?