Recovering Deleted Messages

The request to our labs to recover deleted content of any nature is always, always followed up with the 'how likely' question. Clients nervously passing their device in at reception, knowing the messages or images they deleted recently after a messy break up or incident "must be in there somewhere". We try to talk through points about timing and device architecture but ultimately always land at 50/50 chance. We communicate it would take more investment of time to predict the likelihood of a recovery than it is to process the hardware and find out.

Factors like data traffic across a device, storage architecture, trim employment, last update applied, factory resets and user behaviour all contribute to the needle moving into the green or perhaps the red for a clients case when looking to recover deleted data.

Some data is also easier than others to recover. Recovery of deleted text messages between two Android devices is a more favourable path than recovery of deleted Whatsapp or WeChat messages on IOS. That said, Whatsapp has secondary database files that are goldmines for investigators to reconstruct communications between given parties.

Recovery of a deleted text message is also much more likely than an image purely due the immense disparity in size the two artifacts represent. An image at 1MB is many magnitudes of size larger than an deleted SMS which represents a single line of code in a database.

There is truly very few situations where we can accurately predict the likelihood of data being recovered via osmosis - but - what we can provide as an assurance is that there are teams of developers endlessly scribbling on whiteboards and testing code around the clock to ensure the processes and mining tools we apply to our clients hardware and accounts are the best available. Ultimately, you don't know if you don't look.

If you're looking for evidence from any source and want to talk to an investigator about your case, call through to the lab now on 0800 328 2522 or find us here https://www.datalab.co.nz/digi...

Contact our Forensics Team