The Myth of the "Wiped" Phone
Defendants in criminal and civil cases routinely perform factory resets on smartphones before surrendering them to investigators. What many don't realize is that factory resets don't necessarily destroy forensic evidence — and attempting to destroy evidence can result in severe legal consequences.
What a Factory Reset Actually Does
A standard factory reset typically removes user data from the file system's directory structure, making files inaccessible through normal means. However, the underlying data often remains in unallocated storage space until overwritten by new data. Skilled mobile forensics examiners can frequently recover this data.
What We Can Recover
Depending on the device, operating system version, and encryption status, our mobile forensics team can potentially recover:
- Text messages and iMessages, including deleted conversations
- Call logs
- Photos and videos
- App data from social media, messaging, and communication apps
- GPS location history
- Browsing history
The Encryption Challenge
Modern smartphones — particularly those running iOS 17+ and Android 14+ — use robust full-disk encryption that makes raw data recovery exponentially more difficult. However, law enforcement and forensic investigators have other tools: cloud backups, carrier records, and data shared with connected devices.
If you're involved in a legal matter where mobile device evidence is relevant, contact Guardian Forensics immediately. The sooner we can examine the devices, the better your chances of recovering relevant evidence.