Brief Truths About Cell Phone Forensics Extractions and Exams.

  1. Data recovery is not the same as forensics; recovered data will not stand up in court, and the attempts to “recover” data can corrupt or possible taint the results or information obtained.
  2. Deleted data is GONE; just like in computers, cell phones use un-allocated space and a full physical extraction and image of a device can recover and restore this un-allocated space (deleted data).  The scope of recoverable data is dependent on the device model and operating system…
  3. Every handheld device is capable of storing some amount of data, no matter how old the device is.  The extent of scope of recoverable data depends on the make, model and operating systems of the device.  That hold true for recovering deleted data as well. Deleted recovery is also dependent on  how heavy of a user the owner is.
  4. Did you know some device are designed to only keep a limited amount of data in specific categories?  For example call log history can be endless or limited to 90 days depending on phone model #.  It can even vary with a specific model on 2 different carriers.