Defending against forensics data recovery -- delete file or restart phone

Questions
1

I read about police forensics possibly being able to recover permanently deleted things from a smartphone.

Let’s say that one has a particularly sensitive photo in their Apple Photos app (stored locally, not on iCloud) on iPhone 16. If one was in a situation where their phone is about to be seized (say they have one minute or less to act) and their goal was to defend against the police forensics recovery of that specific photo, what do you think would be the better course of action? Also assuming that the user has latest iOS, Lockdown Mode, an uncompromised device passcode with 8 diceware words and before they take either of the following actions, their phone is in “After First Unlock” (AFU).

  • Delete the photo from the Apple Photos app. Then, go in to the Recently Deleted album and delete that photo. Phone is in AFU at time of seizure.
  • Shut down iPhone by pressing and holding side button and either volume button then dragging Power Off slider. Phone is in “Before First Unlock” (BFU) at time of seizure.
2

Deleting specific files does not guarantee that they are not recoverable.

If time is very limited, I would always try to achieve BFU state to attain the highest level of security possible, since AFU iPhones have been exploitable in the not so distant past.

1 Like
3

Welcome!

BFU/encryption won’t offer protection if the owner can be coerced to unlock the phone or decrypt data. Some jurisdictions have mandatory decryption or data access where the owner of a device can be punished if they do not unlock their device. If police, military, security forces, border agents, gangs etc applying coercion is a concern, sensitive data should not be carried except in a way which it cannot be found.

There are a few threads in this forum about how to cross borders (airports and so on), and these contain some solutions/suggestions that may fit your situation.

1 Like