We recently testified in a case where the all-important video was deleted from an iPhone and from the iPhone’s Recently Deleted folder. How can a lawyer recover deleted mobile evidence upon which the case will turn in court?
We ran an experiment in our lab using a test iPhone with the same operating system version as the specimen iPhone and recorded half a dozen short videos. We deleted the videos from the test iPhone and from the Recently Deleted folder to match the facts. We immediately examined the test iPhone forensically and they were gone. But much to our surprise, the videos remained in the connected iCloud account. We examined it again the morning before trial, four full days later, and the deleted videos were still there. We checked the iCloud account three weeks after trial and Apple had finally deleted them.
The Bottom Line
So what can lawyers learn from this case? If any evidence you need goes missing from an iPhone, always think of the connected iCloud account. There’s a good chance your evidence is there. Even if it was recently deleted, your digital forensics expert may succeed in forensically collecting it from the iCloud account before Apple expunges it.
