What modern encryption changes, where deleted or inaccessible data may still exist, and when recovery becomes a forensic matter.
By Navid Sobbi, Founder and CEO, NSI Global
ORIGINAL PUBLICATION: 23 November 2020 REVISION COMPLETED: 21 September 2026 AEST
Mobile phone data recovery is no longer simply a matter of scanning storage for deleted files. Modern iPhone and Android devices use strong encryption, layered security controls and cloud-connected services, while important information may exist across the handset, backups, linked devices, messaging platforms, email accounts and enterprise systems.
For someone who has lost irreplaceable photos, business records or important messages, the objective may be straightforward: recover as much useful data as possible. In a legal, corporate or investigative matter, the requirement is different. The data may need to be preserved, acquired and documented in a way that allows its origin, integrity and limitations to be explained later.
The practical question is therefore not just “can this phone be recovered?” It is: what information are you trying to recover, where else might it exist, what is the current state of the device, and what is the consequence if the next recovery attempt changes or destroys what remains?
Mobile Phone Data Recovery Has Changed
The 2020 version of this article reflected an earlier recovery model: damaged storage, deleted files and specialist extraction from the handset itself. That remains relevant, but it is no longer the whole picture. Encryption is now central to modern mobile security. Apple protects user data through a hierarchy of cryptographic keys, while Android devices launching with Android 10 or later are required to use file-based encryption.
Those protections are designed to make unauthorised access difficult. They also change what is technically possible after deletion, damage, a reboot, a passcode change, a factory reset or loss of access to the account that holds a backup.
At the same time, mobile data has become more distributed. A photograph may exist in the phone, iCloud or Google Photos, a computer import, a message attachment and another person’s device. A business document may also exist in email, Microsoft 365, Google Workspace, a messaging platform or an enterprise backup. Good recovery work follows the information rather than assuming the handset is the only source.
What People Mean by “Mobile Data Recovery”
The same search term can describe three very different problems, and choosing the right service matters.
| Need | Primary Objective | What Matters Most |
| Personal data recovery | Recover valuable photos, videos, contacts, documents or other information. | Maximising useful recovery while avoiding unnecessary damage or overwriting. |
| Forensic data recovery | Recover data that may be used in litigation, an investigation, insurance matter or regulatory process. | Preservation, provenance, chain of custody, reproducibility and clear limitations. |
| Mobile device forensics | Reconstruct activity, communications, applications, locations, user actions or compromise indicators. | Evidence context, timelines, artefacts, multiple data sources and expert interpretation. |
Recovery Outlook Depends on the Situation
There is no responsible universal success rate for mobile phone data recovery. Device condition is only one variable. Encryption, passcode state, operating-system generation, account access, available backups, app behaviour and what happened after the loss can be equally important.
| Situation | General Outlook | Why |
| Broken screen; phone still powers on | Often favourable | The data may still be intact if the device can be safely accessed and authenticated. |
| Phone will not power on | Device-specific | Board damage, storage condition, encryption and access credentials all affect the options. |
| Liquid damage | Time-sensitive | Repeated charging or power attempts can worsen physical damage and reduce later recovery prospects. |
| Recently deleted files or messages | Variable | The application, encryption, synchronisation and subsequent device activity determine what survives. |
| Completed factory reset | Often poor for old internal plaintext | Modern cryptographic erase can render prior handset data inaccessible even if encrypted blocks remain. |
| Cloud or computer backup exists | Often the best path | A preserved copy may provide the information without depending on erased internal storage. |
| Forgotten passcode | Model and state dependent | Access depends on device generation, security state, available methods and lawful authority. |
| Evidence needed for court or investigation | Forensic process required | The method and documentation matter as much as the recovered content. |
| Suspected spyware or compromise | Not an ordinary recovery job | The device may require compromise analysis, timeline reconstruction and evidence preservation. |
iPhone Data Recovery in 2026
Modern iPhones protect files using Apple’s Data Protection architecture. Files are encrypted with per-file or per-extent keys, and the wider key hierarchy is tied to hardware security and, for some protection classes, the user’s passcode. This is why removing storage from a modern iPhone does not simply produce readable user files.
The state of the phone matters. A functioning and unlocked device can present very different opportunities from a device that has rebooted, is locked, has suffered board damage or has completed Erase All Content and Settings. Apple documents that erasing the relevant cryptographic material renders prior user data cryptographically inaccessible.
For that reason, an iPhone recovery assessment may need to consider more than the internal storage. Useful information may also be available from iCloud Backup, iCloud Photos, synchronised Apple services, local Finder or historical iTunes backups, linked Apple devices, email accounts, application-specific storage and other authorised sources.
For the specific factory-reset question, see Can Data Be Recovered After a Factory Reset? iPhone and Android Forensic Recovery
Android Recovery Is More Device-Specific
Android covers a much wider range of manufacturers, chipsets, storage configurations and operating-system histories. Android 7 introduced file-based encryption, and devices launching with Android 10 or later are required to use it. This means current Android recovery must account for the device’s original launch version, manufacturer implementation, lock state, storage design and whether removable media was used.
Some Android devices also use microSD storage. That can create an additional recovery source, but the card may have been separately erased, damaged or configured as encrypted adoptable storage. It should not be assumed that removable media is automatically readable.
Google backups can preserve supported categories such as apps and app data, call history, contacts, settings, SMS/MMS and, in some configurations, RCS messages. Manufacturer cloud services and application-specific backups may add further sources. Not every app backs up every data category, and backup availability must be checked rather than assumed.
The Handset Is Only One Place the Information May Exist
A good recovery assessment maps the wider information environment before declaring data lost. Depending on the matter and lawful authority, relevant information may survive in several locations.
| Potential Source | Examples of Recoverable Information | Important Limitation |
| Handset | Files, app data, messages, logs, metadata and system artefacts. | Encryption, lock state, deletion and damage may restrict access. |
| iCloud / Apple services | Backups, photos, notes, files, contacts and synchronised data. | Availability depends on account access, settings, timing and deletion behaviour. |
| Google services | Device backup, contacts, photos, messages and supported app data. | Not every category or app is included. |
| Local computer backup | Historical iPhone or Android data stored on a Mac or PC. | The backup may be old, incomplete or separately encrypted. |
| Linked devices | Messages, attachments, synced files and app content. | Deletion or sync may have propagated. |
| Messaging-platform storage | Conversation history, media or account records. | End-to-end encryption and app-specific retention rules can limit availability. |
| Email / cloud / SaaS | Messages, attachments, files, logs and version history. | Requires lawful authority and valid access. |
| Enterprise systems | MDM records, cloud data, business communications and logs. | May preserve event evidence rather than a complete handset copy. |
| Another participant’s device | Messages and attachments retained at the other endpoint. | Must be interpreted in context and obtained lawfully. |
Related capability: Social Media and Cloud Forensics
When the Phone Is Physically Damaged
Physical damage and logical data loss are different problems. A device with a cracked screen may still have intact storage and a straightforward access path. A phone with liquid damage, failed power rails, damaged board components or storage faults can require a more careful engineering assessment before any acquisition is attempted.
Repeated power-up attempts are particularly risky on liquid-damaged or electrically unstable devices. Current SWGDE mobile-evidence guidance recommends leaving a device off when it is received powered off and warns that applying power to a damaged device can cause further damage. A powered-on evidentiary device, however, should not be treated with a universal “turn it off” rule because loss of power or reboot can reduce data availability.
The correct preservation step therefore depends on the state in which the phone is received. If the data may become evidence, document the device state, minimise unnecessary interaction and obtain device-specific advice before changing power, network or security settings.
Deleted Data and Factory Resets Are Not the Same Problem
Ordinary deletion can leave recoverable traces in application databases, backups, synchronised services or other artefacts, depending on how the application and operating system manage the information. A factory reset is more fundamental because it can destroy or replace the cryptographic material needed to interpret the previous user data.
Apple states that Erase All Content and Settings obliterates keys in effaceable storage and renders prior user data cryptographically inaccessible. On modern Android, file-based encryption and hardware-backed key protection likewise mean that “reading the flash chip” is not equivalent to recovering the former user data.
This is why the older explanation that a factory reset merely deletes the address of files should no longer appear on the NSI site. In many cases, the more productive recovery path is to locate an independent copy in a backup, cloud service, linked device or other authorised source.
SIM Cards Play a Smaller Role Than They Once Did
Older mobile phones could store meaningful contact and message data on the SIM. On modern smartphones, most user content lives on the handset, in applications or in cloud-connected services. SIM/UICC examination can still be relevant for subscriber identifiers, network-related information and limited stored records, but it should not be presented as a universal source of deleted messages or contacts.
Whether a SIM contains useful evidence depends on the device generation, carrier, configuration and the specific investigative question. The same principle applies to eSIM: subscriber information may matter, but it is not a substitute for examining the phone and its wider account environment.
Before You Install Recovery Software
Consumer recovery software is not automatically inappropriate. If the lost data is replaceable, the device is not evidence and the consequence of failure is low, a self-service attempt may be an acceptable choice. The decision changes when the data is irreplaceable, commercially important or potentially evidentiary.
Installing software, restoring multiple backups, rooting or jailbreaking a device, repeatedly reconfiguring accounts or continuing heavy phone use can change data, metadata and synchronisation state. Some tools marketed as “factory reset recovery” simply enumerate information that has already resynchronised or remains accessible through an account; they do not bypass the consequences of modern cryptographic erase.
The useful question is not “is DIY software bad?” It is “what happens if this attempt reduces the remaining chance of recovery or makes later interpretation harder?”
For a fuller decision framework, see DIY Data Recovery Risks: Protect Evidence
Personal Value Can Be Just as Important as Legal Evidence
Not every recovery matter belongs in court. A phone may contain the only photographs or videos of a deceased loved one, years of family history, a university thesis, research material, creative work, small-business records, financial information or other data that cannot be recreated.
Where permanent loss would be personally devastating, financially significant or academically damaging, professional assessment can be sensible even when the information has no evidentiary purpose. The recovery strategy should reflect the value of the data, not merely the resale value of the phone.
When Mobile Data Recovery Becomes Digital Forensics
The process changes when the recovered information may be relied upon in litigation, an internal investigation, an insurance matter, a regulatory response or criminal proceedings. It is no longer enough to produce files. The examiner may need to show where the data came from, how it was acquired, what changed during acquisition, which artefacts support the interpretation and what limitations remain.
For evidentiary matters, NSI Global applies its Nine-Stage DFIR-EDM methodology: Legal Notices and Authority, Chain of Custody, Preservation, Collection, Processing, Analysis, Review, Production and Reporting. Cryptographic hashing is used where appropriate, and the resulting work can support reports, affidavits and expert evidence.
NSI Global’s current digital-forensics material distinguishes standard data recovery from digital forensics in the same way: ordinary recovery focuses on retrieving files, while forensic work adds evidence preservation, documentation, analysis and defensible reporting.
Related capability: Digital Forensics
More Than 40,000 Supported Mobile Device Types
NSI Global’s Digital Forensic Unit can recover deleted data from more than 40,000 mobile device types, including smartphones, tablets and smartwatches; however, device support does not mean that every deleted, erased or factory-reset data set will be technically recoverable, as encryption, device state, operating-system architecture and available evidence sources ultimately determine the outcome.
Learn more: Digital Forensic Data Recovery
Which Service Fits the Problem?
| Your Objective | Likely Service Path |
| Recover family photos, videos or personal files | Data recovery assessment |
| Retrieve inaccessible business records | Data recovery or forensic assessment, depending on consequence and context |
| Recover deleted employee communications | Mobile device forensics / digital forensics |
| Investigate misconduct, fraud or IP theft | Digital forensic investigation with evidence preservation |
| Prepare evidence for litigation | Forensic acquisition, analysis, reporting and chain of custody |
| Determine whether a phone was compromised | Forensic spyware and malware detection |
| Recover messages from apps or cloud services | Mobile, social-media and cloud forensics |
| Assess a factory-reset phone | Post-reset forensic assessment plus alternate-source recovery |
If the issue is suspected compromise rather than ordinary data loss, see Forensic Spyware and Malware Detection
Mobile Phone Data Recovery Across Australia
NSI Global provides authorised digital-forensic and mobile-data-recovery services across Australia. The service is not limited to a single city; the appropriate preservation, transfer and examination workflow depends on the device, the urgency of the matter and whether the information may later be relied upon as evidence. Where a matter is evidentiary, sensitive or legally managed, the instruction pathway and evidence-handling requirements should be established before acquisition begins.
NSI Global’s digital-forensics practice works with corporate organisations, government agencies, law-enforcement bodies, law firms, insurers, regulators and appropriately authorised case-managed matters. Personal-safety and sensitive legal matters may require instruction through a lawyer, case officer, investigator, insurer, government agency, law-enforcement body or other authorised representative.
Frequently Asked Questions
Can Deleted Data Be Recovered From a Mobile Phone?
Sometimes. Recovery depends on the device, operating system, application, encryption, time since deletion, subsequent activity, available backups and whether another copy exists elsewhere. No examiner can responsibly guarantee deleted-data recovery before those factors are assessed.
Can iPhone Data Be Recovered if the Phone Will Not Turn On?
Potentially, but the outcome depends on the physical fault, device generation, storage and encryption state. Some failures can be stabilised sufficiently for acquisition; others may prevent access to the cryptographic material needed to decrypt user data.
Can Android Data Be Recovered From a Dead Phone?
Sometimes. Android recovery is highly device-specific. Board condition, chipset, encryption, lock state, Android version and the availability of removable storage or cloud backups all affect the options.
Can Data Be Recovered After a Factory Reset?
Modern encrypted smartphones can make the previous internal data cryptographically inaccessible after a completed reset. Recovery may still be possible from cloud services, backups, linked devices, enterprise systems, app-specific storage or other authorised sources.
Can Deleted Text Messages Be Recovered?
Sometimes. Messages may survive in device databases, backups, synchronised services, linked devices, application storage or the other participant’s authorised device. The result depends on the messaging technology and what happened after deletion.
See also: Can Deleted Text Messages Be Recovered? iPhone and Android Forensic Recovery
Can Photos Be Recovered From a Damaged or Reset Phone?
Often the best route is an existing copy in iCloud Photos, Google Photos, a computer import, cloud storage, shared album, messaging attachment or another device. Direct recovery from damaged or reset encrypted internal storage depends on the device and its security state.
Does a SIM Card Store Deleted Messages?
Modern smartphones usually store user communications on the device, in applications or in cloud services rather than relying on the SIM as the primary message store. A SIM may still contain limited subscriber or stored information, but it should not be treated as a universal deleted-message source.
Should I Turn a Phone Off Before Data Recovery?
Not as a universal rule. If a device is already off, current SWGDE guidance recommends leaving it off. If an evidentiary device is powered on, rebooting or losing power can reduce data availability. Minimise interaction and obtain device-specific advice before changing power or network state.
How Much Does Mobile Phone Data Recovery Cost?
Cost depends on the device, damage, access state, recovery objective, urgency and whether the matter requires forensic acquisition, cloud or backup work, analysis and formal reporting. An assessment is needed before a meaningful estimate can be provided.
What Is the Difference Between Data Recovery and Digital Forensics?
Data recovery is primarily concerned with retrieving information. Digital forensics adds preservation, chain of custody, validated acquisition methods, analysis, provenance and reporting so that the evidence can be explained and defended in legal, regulatory or investigative settings.
Sources and Further Reading
- Apple Platform Security – Data Protection in Apple devices – Apple’s explanation of per-file encryption, key hierarchy and cryptographic inaccessibility after erasure.
- Apple Platform Deployment – Erase Apple devices – Apple guidance stating that Erase All Content and Settings obliterates keys in effaceable storage and renders user data cryptographically inaccessible.
- Android Open Source Project – File-based encryption – Android documentation confirming file-based encryption and the requirement for devices launching with Android 10 or later.
- Google Android Help – Back up or restore data on your Android device – Official overview of Android backup categories, encryption and restore behaviour.
- SWGDE – Best Practices for Mobile Device Evidence Collection, Preservation, Handling and Acquisition – Current mobile-evidence guidance covering device state, power, network isolation, damaged devices and acquisition.
- NSI Global – Digital Forensics – NSI Global’s current digital-forensics scope, evidence-preservation approach and distinction between ordinary recovery and forensic work.
- NSI Global – Digital Forensic Data Recovery – Current NSI Global data-recovery capability, including support for more than 40,000 mobile device types.
- NSI Global – Social Media and Cloud Forensics – NSI capability for authorised cloud, social-media and messaging-platform evidence.
