IT Forensics and Deleted Information

Today, we live in a world where we rely on mobile phones, tablets and computers more than ever before to make phone calls, send messages and emails or browse the web and download images or files. IT forensics is becoming increasingly important, as most of us tend to store copious amounts of information on these devices; from phone numbers and addresses to photos and emails. We rarely consider what may happen if that information is lost or deleted, either by ourselves or by an unauthorised person or virus.

Digital forensic investigations often occur when clients wish to retrieve information that has bearing on a divorce or family dispute matter from a digital device. In many cases, clients may have received demands or threats via text, email or Facebook message on their mobile phone from the other party and have since lost or accidentally deleted the information. Other times our clients’ computer or tablet may have been used by the other party to visit illicit or deviant websites and the client requires assistance to show that such activity did take place.

IT forensics and the recovery of deleted information does have an application in the corporate world; our digital forensic team have been tasked to recover deleted or missing information that may determine where an employee was when he placed or received a certain phone call, at what time confidential, defamatory or threatening messages were sent from a device or when and where indecent images were downloaded. The recovery and presentation of deleted or missing information can determine the guilt or innocence of an employee and reduce the need for costly claims and litigation.

Digital information can end up in the recycle bin and deleted files can often be retrieved by analyzing the contents of the deleted areas of the hard drive. Deeper analysis and IT forensics can reveal much more, such as deleted web browsing history, bookmarks, cached Web pages and images, stored form values and passwords, providing important evidence that is not otherwise available.

For mobile phones, this information may be stored on the SIM card, on the phone’s inbuilt memory or else on an SD card inserted into the phone. For a tablet or computer, web browsing data is often stored in a cache file whilst email messages may be found in the mail file or else in the deleted section of the drive.

Mobile phones offer unique challenges when it comes to IT forensics and the recovery of deleted and missing data. The main issue is that phone manufacturers install different Operating Systems [OS] on their phones therefore different forensic tools are needed to examine an Apple, Android, Nokia or HTC phone. However, Summit Investigations has experienced digital forensic examiners with the latest tools.

Once we can retrieve a deleted or missing dialed phone number, text message or photo, then we can undertake further steps to identify the person being communicated with and the date, time and duration of any activity. In some cases, we are even able identify the location of a mobile phone when a call was made or a photo taken.

The laws which govern IT forensics and the analysis and recovery of data from a mobile phone or other device [digital camera, USB memory drive etc.] vary from state to state across Australia, and in some cases Commonwealth law may come into effect. However, as a rule of thumb, if you own the device in question then you should be able to undertake the retrieval of deleted or missing data from your mobile phones, digital camera, GPS unit, tablet or computer. We assess each digital forensic matter on a case by case basis and will only examine a device once we are confident that we have the lawful right to do so.

If you have a need to recover lost or deleted information from a digital device, then contact us at Summit Investigations for a free consultation. We at Summit Investigations have a proven track record in success and compliance with the laws of IT forensics and the procedures involved in recovering lost and deleted information.

Please feel free to call us direct on now on 1300 610 599 to discuss your requirements or else send an email to our confidential address and we will contact you at your convenience. Summit Investigations operates Australia wide, from Adelaide, Melbourne, Sydney and Brisbane across to Perth, as well as overseas.