Mobile evidence guidance
Can deleted voice notes, photographs and videos be recovered?
Sometimes. Copies may survive in application media folders, photo libraries, caches, thumbnails, backups, exports and recipient devices even when the visible message has gone.
Potential evidence sources
Where relevant records may exist.
- Application media directories
- Photo and video libraries
- Thumbnails and caches
- Cloud photo services and backups
- Exports, shares and downloaded copies
- Recipient or group devices
Decision factors
What materially changes the prospects.
- 01Whether media was downloaded or saved
- 02Storage type and encryption
- 03Deletion method and elapsed time
- 04Cloud synchronisation
- 05File hash or metadata matches
Evidential limitations
What must not be overstated.
Recovered media may lack its original conversational context
Metadata can be altered by export or sharing
A thumbnail is not equivalent to the original file
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
- NIST IR 8354: Digital Investigation Techniques, final scientific foundation review (2022)
Methodological background: discovery is not exhaustive and changing software can change artefact meaning. Not a device-support list.
General methodology · Documentation checked
Confidential case review
