Mobile evidence guidance
Can messages be recovered after a factory reset?
Usually not from the reset handset itself because a modern reset commonly destroys encryption keys. Backups, synchronised accounts, linked computers, recipients and external records may still preserve relevant evidence.
Potential evidence sources
Where relevant records may exist.
- iCloud, Google or manufacturer backups
- Messaging application backups
- Linked desktops and tablets
- Recipient devices
- Email notifications and exported files
- Provider or account records lawfully available
Decision factors
What materially changes the prospects.
- 01Device and encryption generation
- 02Whether a backup predates the reset
- 03Whether the phone was reused
- 04Application-specific cloud behaviour
- 05Availability of counterpart evidence
Evidential limitations
What must not be overstated.
A reset can make prior local data permanently inaccessible
Post-reset use does not recreate historic encryption keys
Generic data-recovery claims should be treated cautiously
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Apple iCloud data protection
Configuration changes encryption and key availability.
Platform documentation · Documentation checked
- What iCloud backs up
Synchronised content and device backups are distinct.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
