Mobile Forensics · Reporting & Ethics · Lesson 4 of 5

Deleted Data & Its Limits

Learn why deleted often means gone, and where traces can still survive.

Why deleted often means gone

Crime shows suggest that deleted files are always lurking, ready to be brought back. On older phones and computers that was often close to true. Deleting a file usually just marked its space as free, and the data sat there until something overwrote it. Modern smartphones have changed this a lot.

Three things work together:

• Flash storage and TRIM. Phones store data on flash memory chips. After files are deleted, the system can send a TRIM command telling the storage which blocks are no longer in use. The chip's controller can then erase them during its own housekeeping. Android has run TRIM as part of routine idle maintenance for years.
• Per-file encryption. You met this in the Data Protection Classes module of iOS Internals: on an iPhone, every new file gets its own fresh 256-bit key. Android uses file-based encryption (FBE) too, and it's required on all devices launching with Android 10 or later.
• Key discard. When an encrypted file is deleted, its key is thrown away. NIST's guide puts it plainly: with data protection active, the file key is obliterated when the file is deleted, leaving encrypted and generally unrecoverable contents in unallocated space.

That last point matters most. Even if some scrambled bytes survive on the chip, without the key they're just noise. File carving, scanning raw storage for the telltale start and end of deleted files, rarely works on a modern encrypted phone for this reason.

The same idea makes erasing a whole phone fast. On an iPhone, Erase All Content and Settings destroys a key kept in a special erasable area, which Apple says renders all files cryptographically inaccessible. Android's encryption design also aims for keys that can be securely deleted.

So when someone asks, "Can you get back what she deleted last month?", an honest examiner often has to answer: possibly not, and here's why.

What can remain, and what not to claim

Deleted doesn't always mean gone everywhere. Examiners check a few places where traces can survive:

• Inside databases. Many apps keep messages and history in SQLite databases. When a record is deleted, SQLite normally doesn't wipe it right away. Its space joins a list of free pages to be reused later, and older versions may sit in the write-ahead log (WAL), a side file holding recent changes. SQLite's documentation says its secure delete setting, which overwrites deleted content with zeros, is normally off, though an app can turn it on. Because the database file itself still exists, its key hasn't been discarded, so leftovers inside it can be read once the file is acquired.
• Cloud copies. Messages, photos and notes may sync to an Apple or Google account. Getting them is a separate legal process, usually directed at the provider.
• Other devices. The other person in a chat still has their copy. A tablet or laptop signed into the same account may too.
• Backups. An older backup on a computer or in the cloud can hold data deleted from the phone since.

Even these are uncertain. Free pages get reused, apps run VACUUM to rebuild a database, and the WAL is regularly folded back into the main file. Recovery depends on timing and luck.

That's why careful wording matters. Not finding something is not proof it never existed. A report should say "No messages from this contact were found in the extraction", not "The user never messaged this contact." The reverse matters too. A recovered deleted record shows the data once existed, but on its own it doesn't show who deleted it, when, or why.

Overstating in either direction can mislead a court or an employer, and it can cost an examiner their credibility for every case that follows.