Readers like you help support MUO. When you make a purchase using links on our site, we may earn an affiliate commission. Read More.
If you've watched a crime TV show before, you've probably seen analysts extracting data from a phone. How realistic are these procedures, and can the police recover deleted photos, texts, and files from a phone?
Let's look into what a forensic analyst can do with a phone.
Why Mobile Forensic Investigations Happen
A mobile forensic investigation takes place when data on the phone is crucial to a case. Back in 2014, when two Minnesotan girls went missing, digital forensics helped police find their abductor. Many other cases have been broken open by the information taken from a victim's or perpetrator's phone.
Even a simple piece of information, like a single text message, could help investigators solve a case. Other times, it's a more complicated picture painted by deleted call logs, time stamps, geolocation data, and app usage.
Search history could prove to be incriminating. Many types of information could help the police solve a crime—and phones store a lot of that kind of information.
Even if you're not a prime suspect, the police may want to look into your phone. Phones belonging to victims of crimes can provide police with valuable data, especially if those victims are incapacitated or missing.
What Can Police Forensics Find?
Forensic analysts can perform different kinds of data acquisitions. The simplest is known as "manual acquisition," and it involves searching through the phone normally. This doesn't reveal deleted data, so it doesn't tell analysts much.
A "logical acquisition" provides more detailed data. This involves transferring data from the phone to a PC. This transfer makes it easy for forensic investigators to work with the data but is still unlikely to recover deleted information.
When investigators want to see hidden data, they use a "file system acquisition." Mobile devices are big databases, and a file system acquisition gives an investigator access to all of the files in the database. This includes hidden and root files, but still no deleted data.
Finally, there's a "physical acquisition." This is the hardest kind of acquisition, as it needs special tools to dump a copy of the storage into a file. However, this lays everything bare—even deleted files. This allows procedures such as forensic text message recovery to take place.
Can the Police Recover Deleted Text Messages and Media?
You might be wondering how the police can read text messages that have been deleted. In truth, when you delete something from your phone, it doesn't vanish instantly.
The flash memory in mobile devices doesn't delete files until it needs to open up space for something new. It merely "deindexes" it, essentially forgetting where it is. It's still stored, but the phone doesn't know where or what it is.
If the phone hasn't overwritten the deleted data, another piece of software could find it. Identifying and decoding it isn't always easy, but the forensic community has extremely powerful tools that help them with this process.
The more recently you've deleted something, the less likely it will have been overwritten. If you deleted something months ago, and you use your phone a lot, there's a good chance that the file system will have overwritten it already. If you only deleted it a few days ago, the chances are higher that it's still there somewhere.
Some iOS devices, like newer iPhones, take an additional step. As well as deindexing the data, they also encrypt it—and there's no known decryption key. That's going to prove extremely difficult (if not impossible) to bypass.
Many phones automatically back up to the user's computer or to the cloud. It can be easier to extract the data from that backup than from the phone. The efficacy of this strategy depends on how recently the phone had a backup performed and the service used to store the files.
Which File Types Can Be Recovered?
The types of recoverable files may depend on the device a forensic analyst is working on. However, there are a few basic types that are likely to be recovered:
- Text messages and iMessages
- Call history
- Emails
- Notes
- Contacts
- Calendar events
- Images and videos
It's also possible that investigators can trace deleted WhatsApp messages—unless they were encrypted. If you use your Android for file storage, those files might still be hanging around in storage, too.
What About Encrypting Your Phone's Data?
Mobile device encryption poses a big problem for forensic analysis. If the user used secure encryption, and there's no way to get the encryption key, it's going to be difficult or impossible to get any data from the phone. iTunes even asks users to encrypt the backups they make on their computers.
While this makes phones less useful to forensic investigators, there are some ways to get past the encryption. Some phones have backdoors built in that allow professionals access to the files. Other investigators might be able to guess or crack your password.
If they can't, however, those encrypted files are going to cause serious problems. If you're worried about forensic examination of your phone (e.g., you're a journalist with sensitive sources), it's a good idea to use the most secure encryption settings you can.
What About WhatsApp?
WhatsApp makes a big case for privacy, with its end-to-end encryption services and good privacy practices. But can a WhatsApp call be traced? And how do the police recover deleted WhatsApp messages?
At the time of writing, WhatsApp's Security page has some good news for privacy enthusiasts:
Some of your most personal moments are shared with WhatsApp, which is why we built end-to-end encryption into our app. When end-to-end encrypted, your messages, photos, videos, voice messages, documents, and calls are secured from falling into the wrong hands.
This means that cracking WhatsApps' defenses would be a tough challenge for someone wanting to get their hands on your info.
Not only that, but on the WhatsApp Help Center for Information for Law Enforcement Authorities, it states that WhatsApp does not store messages on its servers. The company will comply with police requests, but only "before a user has deleted that content from our service."
However, it's not perfect. For instance, Ars Technica reported that, should someone report content as being unsuitable for the platform, the service will decrypt some of the chat logs and send them to moderators for checking. And law enforcement has been interested in looking at the metadata of communications to catch criminals.
Is Any of Your Information Safe?
In the end, there are no guarantees when it comes to mobile forensic investigation. There's no way to completely secure every piece of data on your phone against a committed and intelligent investigator. At the same time, there's no way to access data on every phone.
However, there's a wide variety of continually evolving tools out there. These take into account the always-changing landscape of data protection. And, of course, there's some luck involved as well.
As always, we recommend the same things if you want to keep your data safe. Encrypt everything. Be smart about where and how you back up. Use strong passwords. Lastly, don't do anything that will put you in the crosshairs of a forensic investigation.
How to Recover Deleted Text Messages
If you feel like performing some do-it-yourself cell phone forensics, you can recover deleted text messages on your phone. There are some limitations you'll have to overcome, but it is possible!
The steps involved are quite lengthy, so be sure to read how to recover text messages on Android or iPhone for the whole picture.
Keeping Your Data Secure
So, can police recover deleted pictures, texts, and files from a phone? The answer is yes—by using special tools, they can find data that hasn't been overwritten yet. However, by using encryption methods, you can ensure your data is kept private, even after deletion.
