Data - Deleted data

MOBILedit Forensic is able to recover deleted data. One method is recovering data from SQLite databases, and another method is recovering the files and folders from Physical images.

SQL databases allow you to recover the data which were marked as deleted or are still present in a database folder. SQLite is the most common way to store data for both iPhone and Android.

Physical images allow you to recover deleted folders and files which are still available through the file system, plus the SQL databases as well, which makes it the best option to obtain the lost data.

With rooted/jailbroken devices, we are able to get straight to the file system and SQL databases as well.

Devices without root access or jailbreaking are the worst recovered, but there is still a chance to obtain some data, even if the data gathered in this way will be significantly less (or none) than with the above option.

Time also plays a big role in data recovery - the longer you wait, the lesser the chances for successful operation. Restarting the device (or even apps) might increase the risk of permanent loss of your deleted data as well.

There is never a 100% guarantee that you will be able to retrieve deleted data. The amount of recovered deleted data depends on various factors, such as the time since the data was deleted, whether or not the factory settings were restored, and so on.

For example, with iOS devices, deleted photos remain on the device for 30 days and for a further 60 days in iCloud.