Exploits, Tools & Data Recovery · Deleted vs Reset: Myths & Reality · Lesson 1 of 5

What Delete Really Does

Follow a deleted photo and a deleted message, and see what is left behind.

Two claims hiding in one myth

Here's a belief you'll hear from friends, repair shops and even some tech articles: a reset phone often isn't really reset, and deleted photos can usually be recovered. It's a very reasonable thing to believe. For years it was close to true, and dramatic news stories still repeat it. But it mixes up two different actions, and on modern phones they have very different answers.

• Deleting removes one item, like a photo or a message, while the phone keeps running and keeps its encryption keys.
• Resetting (a factory reset) erases the whole phone and sets it up as new.

This module is about deleting. The next one is about resetting.

Start with the gentlest kind of delete, the trash folder. When you delete a photo on an iPhone, it moves to the Recently Deleted album. Apple says you can recover anything there within 30 days. Google Photos works the same way: Google says deleted photos and videos stay in the trash for 30 days. A lot of "miracle recoveries" are really just this. The photo was never gone. It was waiting in a folder you can open yourself.

Messages are different. You saw in Mobile Forensics that most apps keep their messages in a SQLite database, one file holding many rows. Deleting a message removes its row from what the app shows you, but the database file itself stays in place, and the old bytes can linger in its free space or in the side file called the WAL until new data overwrites them.

That's the key difference to hold onto. A deleted photo usually becomes its own deleted file. A deleted message usually becomes leftover space inside a file that is still alive.

On the simulated phone, look at the messages table and spot the missing id. Then turn on the recovery switch and read the row that comes back.

Why getting it back depends on luck

So what happens after the trash is emptied? On a modern phone, the answer depends on what kind of thing was deleted.

A photo emptied from the trash. A photo is stored as its own file. You learned in Mobile Forensics that each file on a modern phone is encrypted with its own key, and that the key is thrown away when the file is deleted. The phone can also tell the flash chip that those blocks are free (the TRIM command), so the chip may clear them during housekeeping. Even if some scrambled bytes survive, without the key they're noise. So once a photo has left Recently Deleted, it is usually gone from that phone for good.

A deleted message. The database file it lived in is still in use, so its key still exists. Leftovers inside it can stay readable, but only for a while. Whether they survive depends on things nobody controls after the fact:

• How busy the app is. Each new message may reuse the free space where the old one sat.
• Housekeeping. SQLite folds the WAL back into the main file at a checkpoint, and an app may run VACUUM, which rebuilds the database and drops free space.
• App choices. An app can turn on SQLite's secure delete setting, which overwrites deleted content with zeros.
• Time. The longer the phone is used, the less likely an old row is still intact.

That's why honest forensic examiners say "possibly" and never "always". A message deleted a few minutes ago on a quiet phone has a fair chance of leaving traces. One deleted last year on a phone used every day very likely doesn't.

Notice what this means for the myth. Some deleted data really can come back, but mostly from inside live databases, not deleted photos, and never reliably. And none of it applies once the phone has been reset, which is the next module.