Deleted Data Recovery — What Forensic Examiners Can Actually Recover From a Phone

People delete things for all kinds of reasons — some innocent, some not. What most people don’t realize is that deleting something on a phone doesn’t immediately erase it. It marks the space as available for reuse. Until that space is overwritten, recovery may be possible.

The question isn’t “can deleted data be recovered?” It’s “what deleted data, from which device, under what conditions?”

How Deletion Works on Mobile Devices

When you delete a photo, message, or file on a smartphone:

1. The file system entry is removed — the device no longer “sees” the file
2. The storage space is marked as free and available for new data
3. The actual data remains in storage until new data overwrites it

This is why time matters. A phone that’s been sitting powered off since a crime may have significant recoverable deleted data. A phone that’s been actively used for weeks after the deletion may have overwritten most or all of it.

What Can Realistically Be Recovered

SMS and MMS messages: Standard text messages are stored in SQLite databases. When a message is deleted, the row is removed from the database index, but SQLite databases retain “unallocated” space where deleted records may still reside. Forensic tools parse this unallocated space. Recovery rates depend heavily on database activity since deletion.

iMessage and WhatsApp: Both store messages in SQLite databases. iMessage in iOS creates transaction log files that can preserve deleted message content. WhatsApp databases on Android have shown high recovery rates when extracted before significant new activity occurs.

Call logs: Stored in structured databases. Deleted call records often persist in database slack space.

Photos and videos: Files stored in unallocated space can sometimes be carved using file carving techniques — scanning raw storage for known file headers (JPEG, MP4, etc.) regardless of the file system index.

App-specific data: Varies enormously by app. Some apps overwrite deleted content immediately. Others rely on the OS deletion mechanism.

What’s Rarely Recoverable

Data from encrypted devices (BFU state): If a device is powered off and locked, and the storage is fully encrypted, deleted data is protected by the same encryption. You can’t recover what you can’t decrypt.

Data from factory-reset devices: A factory reset on a modern Android or iOS device cryptographically erases the encryption key. Even if the physical data remains, it’s unreadable without the key.

Data overwritten by normal use: Heavy phone use after deletion dramatically reduces recovery chances. Every photo taken, every message sent, every app update installed potentially overwrites deleted data.

End-to-end encrypted messages: Signal, for example, uses E2EE and also stores messages in an encrypted local database. Even if recovery from unallocated space is possible, the content may be encrypted.

Forensic File Carving

File carving is a technique for recovering data based on known file structure signatures rather than file system entries. A JPEG file always starts with FF D8 FF. An MP4 starts with specific byte patterns. Forensic tools scan raw storage looking for these patterns.

File carving can recover:

Carving produces raw file data without metadata, so recovered files may lack creation dates, GPS coordinates, or filenames.

Cloud Backups: The Recovery Alternative

When device recovery isn’t possible, cloud backups often are. With legal process:

FAQ: Deleted Data Recovery

Q: How long does deleted data stay recoverable on a phone?
A: There’s no fixed answer. On a phone used heavily every day, deleted data may be overwritten within hours. On a phone that’s been powered off and stored, the same data might be recoverable months later. The key variables are storage activity and time.

Q: Can a forensic examiner recover deleted Snapchat messages?
A: Rarely. Snapchat is designed to delete content from both the device and its servers quickly. Some metadata artifacts may persist, and certain older versions had database remnants, but current versions provide very little to recover.

Q: If I delete something and then do a backup, is it in the backup?
A: If you back up before deleting, the backup contains the deleted item. If you back up after deleting, the backup typically won’t contain it — but the deleted item may still be recoverable from the device’s unallocated storage.

Q: How long does a typical forensic examination take?
A: Timelines vary based on data volume and case complexity. A single device may take one to three days; multi-device investigations can span weeks.

Q: What certifications should a digital forensics examiner hold?
A: Common certifications include EnCE, CFCE, CCE, and GCFE. Relevance depends on the examination type and the jurisdiction’s expectations.

Case Example

In a civil dispute, one party alleged digital evidence had been altered after a preservation obligation arose. The forensic examiner compared file system metadata against the litigation timeline and found several files modified after the preservation letter was received. A system cleanup utility had been run during the same period. The examiner documented the specific artifacts indicating post-preservation modifications, distinguishing between routine system operations and deliberate user actions, providing the court with a factual basis for evaluating the spoliation claim.

Practitioner Takeaways

• Verify forensic images with cryptographic hashing before analysis.
• Document every examination step for reproducibility.
• Cross-reference findings across multiple artifact types.
• Note tool versions used — behavior changes between versions affect reproducibility.
• Distinguish facts from inferences in your report.

See also: Deleted Message Recovery Limits Defensible Reporting | Prove Someone Deleted Messages | Gdpr Data Forensics