Exploits, Tools & Data Recovery · Deleted vs Reset: Myths & Reality · Lesson 3 of 5

Where Copies Hide

Map the clouds, computers, cards and other people's phones that keep copies.

Synced is not the same as backed up

When someone "recovers" a photo that was deleted from a phone, it very often never came from the phone at all. It came from a copy somewhere else. To protect your own data, or to understand a news story, you need to know where those copies live.

Start with the cloud, and one distinction that trips people up:

• Syncing keeps the same library matched across all your devices. A change in one place happens everywhere. Apple says that when you use iCloud Photos and delete a photo on one device, it's deleted on all other devices signed in with the same Apple Account. A synced library follows your deletions, after its own Recently Deleted period.
• Backing up takes a snapshot at a point in time. A backup made last month holds whatever was on the phone last month, including things you've deleted since.

So the question is never just "is it in the cloud?" It's "which copy, made when, and does it follow deletions?"

Copies that often outlive a deletion include:

• Computer backups. A phone backed up to a laptop leaves a full snapshot on that laptop, which stays until someone deletes it.
• A second photo service. Plenty of people use iCloud Photos and also have Google Photos, or a storage app like Dropbox, uploading in the background. Deleting from one doesn't delete from the other.
• Shared albums and sent photos. Once you've shared or sent a photo, the copies that went out are no longer yours to delete.

You saw in iCloud & Your Apple Account how backups protect you when a phone is lost. The same feature means a reset phone can lose nothing at all, because the data lives on elsewhere. That's good news when it's your backup, and something to think about before you assume a deletion is complete.

Other people, other devices, other chips

Beyond your own cloud, copies hide in places that a reset of your phone never touches.

• The other person's phone. Every message you send exists on the recipient's device, and often in their backups too. Some apps offer an option to delete a sent message for everyone, but the recipient may already have read it, screenshotted it, or backed it up.
• Your other devices. A tablet or laptop signed into the same messaging account can keep its own copy of your conversations. A smartwatch may hold recent notifications, messages and photos synced from the phone.
• Memory cards. Some Android phones take a removable microSD card. Android 6.0 introduced a choice in how a card is set up. As portable storage, it works like a USB stick that any device can read, and Google's documentation describes it as getting only the minimal protection of traditional external storage. As adoptable storage, the phone formats and encrypts the card so it works only with that one phone. A portable card full of photos can be read in any card reader, and a factory reset of the phone may not erase it.
• SIM cards on very old phones. Older phones often saved contacts and sometimes text messages to the SIM card, the small chip from your carrier. The SIM has its own tiny memory, separate from the phone's encrypted storage. Modern phones rarely store much there, but a SIM is still worth removing before a phone leaves your hands.

Put this together with the last module and the myth sorts itself out. A modern reset makes the phone's own storage unreadable. What people actually recover is usually a copy that never lived under the phone's keys: a cloud backup, a laptop backup, a card, or someone else's phone.