Here’s another really good example and technical description of how to recover lost or deleted data from a mobile device. Here’s a perfect example from a large-scale technical magazine, Computer World, which has an article about deleted data from a mobile device and it talks about where they purchased some electronic devices where the owners thought they had deleted data. And they purchased these devices from eBay. They used one type of forensic software and you know this FTK imager and some other software that kind of things that licensed investigators such as our agency used to recover this data.
So you erase your data but what really happens to those deleted files? When a file is deleted, the operating system merely deletes the core pointers and marks the space it occupies as free meaning that the file’s not deleted. The data is still there, but it basically just tells the phone if you need this space you can put something else in it and overwrite it. But usually, that doesn’t happen very quickly. The study said that everybody who sold their phone thought they had cleaned their data completely. Yet, this research has recovered over 750 emails, more than 250 contact names, and four previous owners’ identities. They found filled-out loan applications, selfies, and many other private personal pieces of information.
The way they did it was mass storage mount, logical analysis, and low-level analysis. Basically what you do is dump the blocks of unallocated data that are in the phone. Those are things that have data in the files but aren’t allocated to a certain index listing. And when you do that, you’ll find, very extensive pieces of wiped data. Right. Things like pictures, map locations, and even apps that had contacts that were deleted. One of the most common pieces of deleted information that people think goes away is images. Camera phone pictures are taken, you delete them, and you think it’s gone from your phone. Those pictures not only stay in the phone but sometimes they’re automatically uploaded to that person’s cloud account whether it’s iCloud or Android or Google. Sometimes those pictures go elsewhere.
If you are a party to a lawsuit or some type of court case, and you think that having data from a phone might be of assistance don’t feel as if the phone is supposedly deleted on a regular basis. That those records might still not be available. They did this on both blackberries, iPhones, and Android devices. And they found data on all the examples, right? And they said even after previous owners had performed a factory reset or delete all operations. So you might think you do a factory reset on your phone, and all your data is gone. It can still be recovered from the record. So if you have questions about recovering lost data or recovering records that somebody tried to delete intentionally, check out our website. Try to arrange a consultation and we can give you some information on how you might be able to recover data that might be helpful to you for a court case or even confronting a party about inconsistent statements.
Wanted: The Truth
Active Intel Investigations is here to help you with every aspect of your investigation, from conducting the investigation to preparing evidence to provide it in court.
Get started with your investigation, browse our video library for investigative resources, or schedule a no-obligation consultation with a licensed private investigator to discuss the specifics of your case.
