Defending against forensics data recovery -- delete file or restart phone

Questions
1

I read about police forensics possibly being able to recover permanently deleted things from a smartphone.

Let’s say that one has a particularly sensitive photo in their Apple Photos app (stored locally, not on iCloud) on iPhone 16. If one was in a situation where their phone is about to be seized (say they have one minute or less to act) and their goal was to defend against the police forensics recovery of that specific photo, what do you think would be the better course of action? Also assuming that the user has latest iOS, Lockdown Mode, an uncompromised device passcode with 8 diceware words and before they take either of the following actions, their phone is in “After First Unlock” (AFU).

  • Delete the photo from the Apple Photos app. Then, go in to the Recently Deleted album and delete that photo. Phone is in AFU at time of seizure.
  • Shut down iPhone by pressing and holding side button and either volume button then dragging Power Off slider. Phone is in “Before First Unlock” (BFU) at time of seizure.
2

Deleting specific files does not guarantee that they are not recoverable.

If time is very limited, I would always try to achieve BFU state to attain the highest level of security possible, since AFU iPhones have been exploitable in the not so distant past.

1 Like