Skip to content 
We recently testified in a case where the all-important video was deleted from an iPhone and the iPhone’s Recently Deleted folder. How can a lawyer recover deleted mobile evidence upon which the case will turn in court?
Deleted video evidence from iPhones, even after being removed from the device and its "Recently Deleted" folder, can often be recovered from the connected iCloud account. Carney Forensics' experiment showed that videos remained in iCloud for up to three weeks after deletion from the device. Lawyers should instruct their digital forensics experts to check iCloud accounts promptly to retrieve such evidence before Apple permanently expunges it.
We ran an experiment in our lab using a test iPhone with the same operating system version as the specimen iPhone and recorded half a dozen short videos. We deleted the videos from the test iPhone and the Recently Deleted folder to match the facts. We immediately examined the test iPhone forensically and they were gone. But much to our surprise, the videos remained in the connected iCloud account. We examined it again the morning before the trial, four full days later, and the deleted videos remained. We checked the iCloud account three weeks after the trial, and Apple finally deleted them.
The Bottom Line
So what can lawyers learn from this case? If any evidence you need goes missing from an iPhone, always think of the connected iCloud account. There’s a good chance your evidence is there. Even if it was recently deleted, your digital forensics expert might succeed in forensically collecting it from the iCloud account before Apple expunges it.
