What can phone forensics find?

If you use your Android for file storage, those files might still be hanging around in storage, too.

However, there are a few basic types that are likely to be recovered:

  • Text messages and iMessages.
  • Call history.
  • Emails.
  • Notes.
  • Contacts.
  • Calendar events.
  • Images and videos.

You might be wondering how the police can read text messages that have been deleted. In truth, when you delete something from your phone, it doesn’t vanish instantly.

The flash memory in mobile devices doesn’t delete files until it needs to open up space for something new. It merely “deindexes” it, essentially forgetting where it is. It’s still stored, but the phone doesn’t know where or what it is.

If the phone hasn’t overwritten the deleted data, another piece of software could find it. Identifying and decoding it isn’t always easy, but the forensic community has extremely powerful tools that help them with this process.

The more recently you’ve deleted something, the less likely it will have been overwritten. If you deleted something months ago, and you use your phone a lot, there’s a good chance that the file system will have overwritten it already. If you only deleted it a few days ago, the chances are higher that it’s still there somewhere.

https://www.makeuseof.com/tag/forensic-analysts-get-deleted-data-phone/

One thought on “What can phone forensics find?

Leave a Reply, All comments will be moderated - Many thanks for your contribution

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.