Porn, Predators, Drug Dealers, and Cheaters: Recovering Deleted iPhone Messages for Fun, Truth, and
There are several reasons you might want or need to recover text messages deleted from a mobile device. Depending on your reasons and your degree of access to the device in question, doing so can range in difficulty from quite simple to virtually impossible, or at least completely counterproductive.
The consequences of a successful data recovery cover an equally broad area on the continuum. In the best case, you get everything you need in a form that is useful (and admissible in court, in the event that the data recovery was for some legal purpose). In the worst case, you spend a few years eating only that portion of your prison food Bubba (or Bertha) doesn't want.
Obeying the Law = Good / Breaking the Law = Bad
Because of the range and severity of consequences faced by those who do things the wrong way, It might make sense at this point to go over some legal basics.
1. ProofNet Investigative Agency is not, never has been, and likely never will be in the business of providing legal advice. Considering all of the potential pitfalls, some very obscure and (from a lay perspective) completely illogical, only a fool would proceed in any endeavor involving the recovery of data from a mobile device (other than his or her own or that of a minor dependent) without first consulting a licensed attorney.
2. Understand the intent of the Electronic Communications Privacy Act, especially the distinction between real-time interception of communications (almost always a no-no) and the recovery of stored data (the area where our efforts should be focused).
Monitoring the online/telephonic activity of your minor child or of employees who have signed a "consent to monitoring" agreement are the only cases in which real time monitoring through the use of "spyware" should even be considered.
A person who has shared a password with someone else has generally forfeited their right to privacy with regard to the information protected by that password.
A person whose mobile device backups are stored in an unencrypted form on a shared device hard drive, partition, directory (folder), or shared cloud server account has for all practical purposes granted permission to anyone else able to access that storage medium.
Data to be used as evidence in a legal proceeding that has been procured in a lawful manner but that has not been protected and documented in accordance with the rules of evidence will very likely end up being found inadmissible.
3. Password protected data which has been accessed through password cracking, keystroke logging, guessing, or clandestine physical or video surveillance will not only be inadmissible, but can also result in the criminal prosecution of the person who cracked the password. And if you think that you can crack your soon-to-be ex-spouse's password and begin accessing their data, claiming that (s)he shared the password with you long ago, you should know that the digital record will reveal the dates upon which each individual device has accessed the account in question. Since no reasonable person would believe that he or she shared the password with you two months into your divorce proceedings (assuming that was the first time that a device with which you are associated began accessing the data in question), you're going to look like an idiot and a liar. So don't be either.
The Correct Approach
Getting the information you need boils down to making sure that three specific criteria are met.
1. You have legal access to the data. This can mean:
you created the data using a device that belongs to you
your dependent child created the data using a device that belongs to him/her (i.e., to you, as the legal guardian)
the data or the password protecting it was shared with you
the data or password was stored in a place to which you have regular and free access
2. The data is stored or archived (as in an online backup) and you retrieve it at a later time
the data was not captured during its creation/transmission, as with a keylogger or spyware (except, again, in the event that the data was created or transmitted by your minor dependent)
you did not use any illegal means to decrypt the data, i.e. password cracking, guessing, spyware, etc.
3. In the event that you will need to use the data as evidence, it must be preserved in its original form, and not changed in any way.
the general standard for meeting this requirement is through the use of a hardware or software write-blocker and the generation of a hash (digital fingerprint) for each copy of the data, which can be matched against the hash of the original.
appropriate documentation of the chain of custody of the data storage medium (the hard drive or flash device) and the data contained therein must be maintained
Some Final Things to Consider
Depending on your purposes and expectations, most of the realm of data recovery falls into a grey area. The only black-and-white areas that exist are those which have been proven through case precedent or codified in statute law.
If your interest in this topic arises from your suspicion that a spouse is misbehaving behind your (or someone you care about's) back, understand that the technical skills that our agency offers are only half of the big picture. A competent attorney is absolutely necessary for the purposes of determining what data is useful in the context of any possible future legal proceedings. If you have legal access to some data but lack the technical skills to convert it into a tangible form, we'll be happy to help, and a free consultation might be a good place to start.
If you are concerned that your child might be communicating with a sexual predator or drug dealers, or otherwise engaging in any other illicit telephone or computer based activity, you have a lot more leeway. Pretty much nothing is off-limits when it comes to a parent's monitoring of a child's online activities. If you need help setting up a monitoring system or accessing deleted text messages, chatroom activity, or internet browsing history, we are here to help. Our service will be completely discreet and confidential up to the point where we detect any child abuse or intent to engage in abuse, at which point we will happily and swiftly comply with Title 34, Chapter 25B of the Alabama State Code and report our findings to law enforcement.
