Sarbanes-Oxley requires corporate record-keeping and outlaws interference with investigations. While it doesn't specifically mention ephemeral messaging, it would seem to preclude its use in anything business-related. So it's not "trying to prove a negative" so much as it seems to be saying these applications are illegitimate for business use period.
Deleting data once litigation has been initiated is tampering/obstruction. Deleting data when not under litigation is the company's choice, with very few exceptions. Many companies explicitly require all communication be ephemeral - email, messaging, etc. it explicitly only preserved for X days and then deleted entirely from all systems.
If not, that would be an oil-tanker sized loophole for avoiding prosecution, and I don't think the folks crafting criminal evidentiary law were that dumb.
If you are under a litigation hold, you cannot delete any data. If you are not under litigation hold, and your policy is that you shred all your records every Friday at 3PM... The courts will not hold your lack of records against you.
Depending on which Federal circuit applies, and how you authenticate to your device, only if they already had proof that your messages were material to the case. Unlocking your device (with a passcode or password, as distinct from biometrics) has been ruled to be "testimonial", so the State must have specific knowledge that your iMessage has inculpatory evidence in order to compel you to unlock it and hand those messages over.
(IANAL.)
Also SOX doesn't pertain here.