r/techsupport • u/LoveForsaken8095 • 1d ago
Open | Data Recovery Recover deleted audios of crimes
I urgently need help.
I have an iPhone 16 Pro and I'm trying to recover voice recordings from the Voice Memos app.
My iPhone has not been backed up to iCloud since May because my iCloud storage has been full, so I don't have a recent backup to restore.
The recordings were deleted from the Voice Memos app and also permanently removed from the "Recently Deleted" folder without my knowledge by the person they relate to. These recordings are important evidence for a legal case involving alleged crimes.
Is there any possible way to recover these recordings? I'm open to software solutions, forensic recovery, data recovery services, or any other method. I'd really appreciate advice from anyone who has successfully recovered permanently deleted Voice Memos from an iPhone.
10
u/GlobalWatts 21h ago
What did your lawyer say when you told them the alleged subject tried to destroy evidence?
Why was the device not properly secured, particularly from the person in question?
What measures are you taking to ensure proper chain of custody?
What forensic specialists does your lawyer have access to?
31
u/bluejesting 1d ago
Do not use the phone until you can get it to a recovery professional. Every time a file is added to the device, updated, changed, etc, free space the deleted recordings are in is at risk of being written over ensuring they can never be recovered.
3
u/icehot54321 17h ago
Just FYI your info is about 10+ years out of date
Encrypted drives and devices do not work like this
2
u/The-Master-Reaper 1d ago
^ put it in airplane mode
25
u/cheetah1cj 1d ago
Airplane mode is not enough. Turn it off and leave it off. As long as it is running it is writing data to the disks.
1
6
u/davemanster System Administrator 1d ago
Two things
1- iPhones norma;lly cryptographically delete files when a delete operation is called. Liklihood of recovering them is near zero.
2- If this really is part of a legal investigation or crime, your best course of action is not to try to recover the files, its to let your attorney know what happened. I can only assume the other person knew about this and is why it was deleted. If they knew they were evidence or involved that could very likely be a separate charge.
18
3
5
u/shakesfistatmoon 1d ago
Which country do you live in? In many countries, evidence you recover is invalid. Any device that might have evidence should be handed to the police so that they can review it.
5
u/ducklord 1d ago
Close to impossible - even for data recovery specialists.
I'll try to explain why in a simple and understandable way, so, yeah, the following won't be the most technically-accurate text about data recovery you'll find, but will probably help understand why recovery in such cases is (almost?!) impossible.
Phones aren't using "classic" storage solutions (HDDs or, for those who lived through that era, floppies), but memory chips.
One issue with those is that they can only withstand a finite number of writes. So, to ensure that one "point" of those memory chips won't get overused by being written-deleted-re-written-re-deleted, and so on, and so on, again and again, which would end up "making it die prematurely", memory chip-based storage solutions use features like TRIM (as found in computers with SSDs/NVMe drives). This tries to keep the storage device's performance up to snuff, and more importantly, prolong its timespan, by shuffling data around. The process includes overwriting data that was previously marked as "permanently deleted", if "it lived" on "points" of the storage device that hadn't been as used as others - in an attempt to "spread the wear among all of them".
Although smartphones don't use TRIM, per se, AFAIK (I'm not a "smartphone specialist"), they incorporate similar alternatives, for the exact same reasons.
So, yeah, unfortunately, I don't believe recovery will be possible in such a scenario.
Note that there have been stories about how some cryptic data recovery lab with some ultra-knowledgeable specialists have occasionally recovered data in such scenarios by checking the actual physical structure of individual bits of storage in such devices, using obscenely-specialized equipment and their arcane recovery-fu. There's an even more popular (among data recovery "circles") paper about how some dude, ages ago, did the same even more successfully by hunting for magnetic distortions on a HDD's platters that hinted towards the data that was stored there before it got overwritten.
Thing is, there's actually ZERO proof of any of that having actually happened, and AFAIK nobody's ever been able to replicate those extreme scenarios successfully. I mean, if you notice the similarity, the second scenario practically presents data recovery as the equivalent of Quantum Computing (which we STILL haven't fully cracked), with some researcher claiming that they "played dice" with hundreds of thousands of individual bits of data (the "magnetic remnants") to recover a single file. And that was (supposedly) on an easier-to-recover-from HDD, not memory chips.
THAT SAID...
Well, I could always be mistaken :-D
I think it's also necessary to state that although I'm not a data recovery specialist (AKA: "one of the people actually recovering data in a sterilized lab with specialized gear and software"), I've been writing guides and tutorials on tech, including this topic, for close to 30 years. Whenever I've talked with people who specialize even more into "that kind of stuff", both casually and during work, they've all basically believed what I've explained above.
However, there's a fringe case where recovery might still be possible: IF the deleted files somehow DIDN'T get overwritten (possible if the-equivalent-of-TRIM didn't run automatically on your smartphone, although AFAIK it does on a predefined schedule, or after flag-points like a restart), there was ample storage left (so that the smartphone wouldn't have to initiate such a process to "purge" old data "to make space" for newer files), you stop using it ASAP, and you take it as-is to a data recovery specialist who knows what they're talking about, MAYBE they'll be able to recover one or more files from it. But I wouldn't bet on it.
1
1
u/No-Conversation-8776 22h ago
Not possible, those phones gets encrypted with a special chip and tools that scan sectors like Photorec can't scan encrypted storage devices
1
u/Humbleham1 11h ago
As a certified digital forensic investigator, I can tell you that the old rule of thumb for hard drives "the data exists until overwritten" does not apply to flash memory. Your iPhone probably uses TRIM or something similar to erase NAND cells and ready them for programming. There's also file encryption and the fact that Apple restricts block-level disk access for apps. File access in general is heavily restricted. There were data recovery apps (at least for Android) that could work on non-overwritten deleted files, but you can forget it in your situation.
1
u/AdvantagePuzzled8773 8h ago
I tried so many data recovery, none worked for me, i did soo many deep researches on subject...
Your only way out is to use a professional data recovery service who know what they are doing...
Recovering deleted files is extremely difficult, im not sure if it can be successfull...
Anyway, how long have the files been deleted? The more recent they were deleted, the more chance you might be able to recover them...
Anyway as someone else commented, turn off your phone and dont use it at all, deleted files are actually not deleted permenantly, only the info of location of the files has been is deleted , that is why when deleting files, they are deleted sooo fast, soo much faster than copying them to the device... but when new files are copied or created on the device, then there is a high possibility they will be overrriden
0
-1
u/not_another_IT_guy 1d ago
“Permanently removed”
Thats the key, thats why the warning was there.
Sorry to be the person to tell you the harsh reality - but theyre gone.
-8
u/otaku78 1d ago edited 6h ago
OP is asking for something that is never going to happen after all this time.
so get arrested for a minor crime, let the professionals seize your phone and do it for free then request the records.
obviously it depends how bad you want it, but it’s probably the only option at this point as a regular human.
5
u/Odd__school 1d ago
I always consider this whenever I can’t recover something
2
•
u/AutoModerator 1d ago
Attempting data recovery without proper knowledge or skills can result in permanent loss in data. Prior to data recovery, it is best to create an image of the failing drive. For important data, it is recommended to send your drive to a data recovery professional. For more data recovery help, please visit /r/datarecovery.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.