Article

Back to Articles

2017-05-03

what data can be forensically recovered from an iPhone

iPhone data recovery

Every week I get requests from attorneys trying to understand what data can be recovered from a iPhone, or really any mobile phone.

Recent news about apple and the FBI has added a lot of confusion to this question.

So I wanted to clarify for you, an attorney so when you get one of these devices in the office and the question comes up here is a brief outline:

*note  - this is as of today.  Technology changes rapidly and the tools we use to recover data changes as well, so very quickly this article may be out of date.  - feel free to call to see if its changed. 

Apple Products

iOS is the operating system 

devices:  iPod, iPads, iPhones

Older phones & devices (the iPhone 4 and earlier)

yes you can recover deleted data

Newer phones & devices (iPhone 4s - iPhone 6)

Very little, if any deleted data can be recovered - you may get very recent deleted text messages (within 30 days - but it’s not guaranteed)

Why? - the deleted data on the phones is really not erased — it’s just encrypted with no known decryption key.

But theres a catch!  

Thinking outside the box a little helps with problem….what about an iCloud backup or an iTunes backup?  if the device was ever connected to a computer or if iCloud was set up on the phone, it likely has a backup (or multiple backups of the device!)  I have had personal success recovering what what believed to be deleted just from the iCloud backup.

 

Can I just call the phone carrier and get a copy of the text messages?

Unfortunately phone carriers do not store the content of text messages. Simply because billions of them transfer across their network every day. Carriers can provide a log (not the content) of text messages in some circumstances with a subpoena.

Android Devices

stay tuned…we’ll talk about recovery from Android devices in a future article. 

 

© 2017 Forensic Pursuit. All rights reserved.