|
Somebody deleted stuff off my phone (I swear it wasn’t me!). Can I get it back? – Copyright Steve Burgess 2024 Your phone is suddenly losing text, videos, photos. What’s happening? Are they gone forever? Have I been hacked? How do I avoid this in the future? What’s happening? Of course, it’s hard to tell without some history of the phone’s use, but depending on a number of conditions, it could be due to syncing, could be user error, could be “undocumented features.” Syncing: Google and and Microsoft want you to make your data accessible on all of the devices that run their particular operating system (OS). So, they encourage you “sync” it to “the Cloud.” This just means they automatically copy it to a computer somewhere that they control. They encourage you so much that after the next OS update, you might find your device syncing to their cloud without you ever setting it to do so. As a result, when you add data to one device, it becomes available on all of your devices. And unfortunately, when you deleted it from one device, it may get deleted from all of your devices. This is nonintuitive, but ends up in a lot of people losing data accidentally. Solution: Keep a copy of your data backed up offline, by either copying it to your computer, or using a device like the PNY DuoLink. User error: We all make mistakes, including accidentally deleting something when we’re distracted, or deleting a whole folder of photos while thinking we’re deleting just one, or just being distracted as we’re accessing the one irreplaceable text. It happens, because we’re human. Of course, if we were AIs, there would be no predicting what errors we’d come up with! Solution: Know everything and be 100% focused all of the time. Yeah, I know – one can just do their best to stay educated on the countless features of these devices, and computer sober. Solution 2: Keep a copy of your data regularly backed up offline. Undocumented features: Aka, “bugs.” As the kid who tripped his sibling once said, “I dunno Pops, sometimes my leg just sticks out like that when Sis runs past me.” Sometimes phones and computers do unexpected things, There’s not really any software that bug-free. We geeks don’t call them bugs – we call them “undocumented features.” Solution: Keep a copy of your data regularly backed up offline. Are they gone forever? Can I get it back? It may be possible to recover them. There’s not actually any way to predict with accuracy the chances of recovery, but there are factors affecting it. The longer it has been and the more use the phone has had since the deletions, the less likely the recovery. And of course, the converse is true – the less use the device has had since deletions, the more likely they can be recovered. The most important factor is how much activity the device has had since the data disappeared. We use how long it’s been since the deletions as a marker, but it’s really how much use the phones has had since then. If it was deleted years ago, but you turned the phone off right after it happened, the odds are still pretty good that it’s recoverable. When something is deleted, it’s not gone – but it’s marked by the phone’s operating system as empty space. So, when the phone writes new data, it may overwrite the space where the deleted files are sitting, at which point they become unrecoverable. Things that take up a lot of space on a phone are photos, videos, installing new apps, and especially operating system (iOS or Android) updates. Things that take up very little space are texts and phone call records. Things tend to persist for a month or so, after which processes on the phone itself may start to overwrite the blocks containing the previously deleted data. So, the kind of activity and volume of activity has happened on the phone since the deletions, especially those mentioned just above, will help to determine if data is recoverable or has been written over by some other process and hence become unrecoverable. Incidentally, a reset (sometimes called a factor reset) of the phone wipes all of the data and resets the encryption key, so data just can’t be recovered from the device after a factory reset. For those used to hard drives and computers, you know that data can persist for years and be potentially recoverable after a deletion event well in the past. Phones are different and data that has been deleted years ago on a phone that is still in regular use is gone, gone, gone. Can I do this myself? The tools we use at Burgess Forensics (and that the FBI and other law enforcement agencies use) cost tens of thousands of dollars. And they’re very good! But there are consumer-level tools, such as “Dr. Fone.” If you decide to try this yourself, make sure to use a tool that you install on a computer and not on your phone. Then give it a whirl. It might work. Have I been hacked? The TL;DR version is: maybe, but probably not. Modern phones are notoriously difficult (but not impossible) to access without the user’s permission. However, we’re out of room in this article. More in a later update. Steve Burgess is a freelance technology writer, a practicing Computer Forensics and e-discovery specialist and Expert Witness as the principal of Burgess Forensics, and a contributor to the text, Scientific Evidence in Civil and Criminal Cases, 5th Ed. By Moenssens, et al. Mr. Burgess can be reached at http://www.burgessforensics.com, or via email steve@burgessforensics.com
Related Articles -
Deleted, cell phone, hacking, hack, datarecovery,
| 
