We recently testified in a case where the all-important video was deleted from an iPhone and the iPhone’s Recently Deleted folder. How can a lawyer recover deleted mobile evidence upon which the case will turn in court?
We ran an experiment in our lab using a test iPhone with the same operating system version as the specimen iPhone and recorded half a dozen short videos. We deleted the videos from the test iPhone and the Recently Deleted folder to match the facts. We immediately examined the test iPhone forensically and they were gone. But much to our surprise, the videos remained in the connected iCloud account. We examined it again the morning before the trial, four full days later, and the deleted videos remained. We checked the iCloud account three weeks after the trial, and Apple finally deleted them.
The Bottom Line
So what can lawyers learn from this case? If any evidence you need goes missing from an iPhone, always think of the connected iCloud account. There’s a good chance your evidence is there. Even if it was recently deleted, your digital forensics expert might succeed in forensically collecting it from the iCloud account before Apple expunges it.
