A lot of law firms are involved in litigation and investigations that range from divorce to employment disputes and other criminal and civil matters. Often, the evidence a firm is looking for is kept in a mobile device but when data extraction and analysis are done, the data can no longer be recovered. Why is this possible, particularly on mobile devices?
It is important to realize that data deletion does not get rid of the data completely. Deletion may just tell the operating system that the data may be over-written when the system requires space. But, it can be a problem to access the deleted data. Law firms are often looking to recover text and picture messages. But, the data may not be there, depending on some factors such as the following:
Kind of Device
Apple is quite known and especially secure in terms of deleted data. Recovering deleted text messages off an Apple device might be possible. However, there are some factors that come into play. In general, Android devices are a bit easier to recover deleted data from since industry standard forensic tools carry out full physical data extraction from the device. Thus, Elijah digital forensics experts can get all deleted and non-deleted data. As Apple maintains propriety over the algorithms and chipsets on all devices newer than the iPhone 4, it may not be possible to do a full physical extraction.
Device Capacity
Mobile devices have flexible text and picture databases. These databases will expand and contract, depending on the usage. But, when buying a 16 GB iPhone or Android device, the overall memory capacity becomes a problem, particularly when taking usage into account. This is a lot of space for text messages and when the device’s database is growing to a point where the operating system needs to determine where to store all of it, there is an increased likelihood that the deleted messages are over-written.
Usage Level
When looking to recover deleted messages from a user who doesn’t use the phone feature on the device and instead texts all of their communications, there is also an increasing possibility that the deleted messages are over-written. A high level of text database usage on the device reduces the priority of deleted messages. That is why firms have to engage the services of a digital forensics consultant sooner instead of later. As time goes on, the data can go stale and spoiled.
