When you delete a photo from your phone, you might assume it is gone. But law enforcement agencies have access to forensic tools that can reach far deeper into your device than you might expect. This article explains the technology behind digital forensics, what police can and cannot recover, the legal framework surrounding phone searches, and how encryption changes the equation. This is an educational overview of digital forensics, not a guide for evading law enforcement.
How Digital Forensics Works
When you delete a file from your phone, the operating system does not immediately erase the data. Instead, it marks the storage space as available for new data. The actual bits that make up your photo remain on the storage chip until they are overwritten by new files. This gap between deletion and overwriting is what forensic tools exploit.
Cellebrite UFED
Cellebrite is the most widely used mobile forensic tool in law enforcement worldwide. The Universal Forensic Extraction Device (UFED) can perform several types of extraction:
- Logical extraction: Accesses data that the operating system makes available, similar to what you see when browsing your phone normally. This includes current files, app data, and messages.
- File system extraction: Goes deeper to access the file system structure, including databases and files that are not visible through normal navigation.
- Physical extraction: Reads the raw storage chip data, which can include deleted files that have not been overwritten. This is the most thorough method.
GrayKey (Magnet Forensics)
GrayKey, now produced by Magnet Forensics, specializes in bypassing iPhone lock screens. It exploits vulnerabilities in iOS to gain access to locked devices. Once access is obtained, it can perform full file system extractions. GrayKey has been used by law enforcement agencies worldwide and is regularly updated to work with newer iOS versions, though Apple continuously patches the vulnerabilities it relies on.
Other Forensic Tools
Additional tools in the forensic toolkit include Oxygen Forensic Detective, MSAB XRY, and open-source tools like Autopsy. Each has different capabilities, but the principle is the same: access as much data as possible from the device, including data the user intended to delete.
What Can Be Recovered?
The recovery rate depends on several factors:
- Time since deletion: The sooner a forensic examination occurs after deletion, the higher the chance of recovery. As your phone writes new data, it gradually overwrites the space where deleted files resided.
- Device usage: A phone that is heavily used writes more data, overwriting deleted content faster than a phone that sits idle.
- Storage type: Modern iPhones use NAND flash storage with wear-leveling algorithms that spread writes across the storage chip. This can actually preserve deleted data longer, since the device may write new data to different physical locations.
- iOS version and encryption: Newer iOS versions have stronger encryption and more limited forensic access. Devices running the latest iOS with a strong passcode are significantly harder to extract data from.
In general, recently deleted photos have a high probability of recovery. Photos deleted weeks or months ago may be partially or fully overwritten, but fragments can sometimes be reconstructed.
The Legal Framework
In the United States, the Supreme Court ruled in Riley v. California (2014) that police generally need a warrant to search a cell phone. This landmark decision recognized that phones contain vast quantities of personal information and deserve Fourth Amendment protection. However, there are exceptions:
- Consent: If you voluntarily unlock your phone and allow a search, no warrant is needed.
- Border searches: U.S. Customs and Border Protection has broader authority to search electronic devices at the border, though the extent of this authority is still being litigated.
- Exigent circumstances: If police believe evidence is about to be destroyed, they may search without a warrant.
- Search incident to arrest: While Riley limited this exception for phones, some jurisdictions interpret it differently.
Laws vary significantly by country. In the UK, the Regulation of Investigatory Powers Act can compel you to provide encryption passwords, with criminal penalties for refusal. In some countries, authorities have broad power to access devices without judicial oversight.
How Encryption Changes Everything
Here is the critical point: forensic tools can only recover readable data. If a file was encrypted before it was stored on your device, even a physical extraction yields nothing but encrypted noise. Without the encryption key, the recovered data is mathematically useless.
This is why the distinction between "hiding" and "encrypting" matters so much:
- Hidden files (moved to a hidden folder or removed from a visible location) are fully recoverable by forensic tools because the underlying data is unencrypted.
- Encrypted files (protected with AES-256 or equivalent) are recovered as ciphertext, which is indistinguishable from random data without the decryption key.
iPhone Full-Disk Encryption
Since iOS 8, Apple has encrypted the entire contents of the iPhone when the device is locked with a passcode. This provides a strong baseline of protection. However, once the device is unlocked (whether by the user, by guessing the passcode, or by exploiting a vulnerability), the full-disk encryption is transparent, and all files are accessible in their decrypted form.
App-level encryption adds a second layer. Even on an unlocked device, files encrypted by a vault app require the vault's own passcode to decrypt. This is the difference between a locked front door (device encryption) and a locked safe inside the house (app-level encryption).
Responsible Privacy Practices
Understanding forensic capabilities is not about evading justice. It is about making informed decisions about your digital privacy. Journalists protecting sources, lawyers safeguarding privileged communications, activists in repressive regimes, and ordinary people with legitimate privacy needs all benefit from understanding how their data can be accessed and how encryption protects it.
If you want a second layer of encryption beyond what your iPhone provides by default, Stash applies AES-256 encryption to every file the moment it enters the vault. Even on an unlocked device, your vault contents remain encrypted and inaccessible without your personal passcode. Download Stash from the App Store and add meaningful encryption to your most sensitive files.