Often, yes, but not always. A forensic examination can often recover deleted text messages from a phone, sometimes even after a factory reset or an attempt to delete information. Whether a specific message can be recovered depends on the device type, the operating system, the storage technology and how much time has passed since deletion, so an examiner should assess the likelihood before the work starts.
Why Deleted Messages Can Still Be Found
Deleting a message on a phone does not always remove every trace of it. Mobile forensics uses specialized extraction techniques to recover data that may have been deleted or hidden, and that covers far more than texts: call logs, contact information, photos, videos, application data, location information and social media communications.
CKC Consulting examines iOS and Android smartphones and tablets. See our cell phone forensics service for everything a phone examination covers.
What Decides Whether a Message Can Be Recovered
No examiner can promise a specific message before looking at the device. The result depends on:
- The device type and its operating system
- The storage technology the device uses
- How much time has passed since the message was deleted
- Whether the device has been factory reset or wiped
- Encryption or data corruption on the device
We assess the likelihood of recovering the evidence you need at the initial consultation, based on your case and the devices available.
Evidence Can Also Exist Off the Phone
The phone is not the only place to look. Call detail records come from the cell phone provider, not the device, and show the date, time and duration of activity and the cell towers used. They record activity rather than message content, and our call detail records analysis can map a device's movement over time.
Messages and files may also sit in social media accounts or cloud platforms such as M365, Google and Dropbox, which we can collect with preservation requirements in mind.
Why the Method Matters in Court
A recovered message is only useful if it is admissible. The phone is preserved and its data extracted with forensically sound methods, every step is recorded in the chain of custody with timestamps, and cryptographic hashing verifies data integrity throughout the investigation.
If the findings are challenged, our experts can explain them at deposition or trial. See our expert witness testimony.
What to Do If You Need a Phone Examined
Because time elapsed since deletion affects what can be recovered, raise it early. CKC offers a free telephone, video or in-person consultation to discuss the device, the messages you are looking for and your deadlines. From there we provide a proposal with the scope of work, estimated costs and a proposed timeline.
A simple examination of a single device may be completed within a few days, while matters with multiple devices and large data volumes may take several weeks.
