Digital forensics

An examination usually starts with an extraction, a copy of a device's data. A logical extraction gets roughly what a backup would contain. A full file system extraction adds app databases, caches and system logs, and normally needs the device to be unlocked or exploited. Commercial kits automate most of this; the best known are Cellebrite and GrayKey, made by Grayshift, which is now part of Magnet Forensics. Examiners then merge timestamps from many sources into a timeline of what happened when.

Phones encrypt their storage, so the state the phone is in matters a great deal. After a restart, most data stays encrypted until the passcode is entered for the first time: BFU (before first unlock). After that first unlock, many keys stay in memory even when the screen locks again: AFU (after first unlock). On iPhone, data from third-party apps is protected only until first unlock by default (Apple). Forensic tools therefore aim for phones in AFU state, or try to guess the passcode. The disk encryption guide explains the encryption side in more detail.

Passcode guessing is slowed by a security chip. Android's documentation sets a stronger default from Android 16 QPR2: at most 20 wrong guesses, with delays rising to 41 days after the 15th (Android documentation). How well a given phone enforces this depends on its hardware. A random six-digit PIN is safe only while that limit holds. A long alphanumeric passphrase does not depend on it.

What leaked support documents show

• July 2024: Cellebrite documents dated April 2024 showed the company could not unlock a sizable share of modern iPhones (404 Media).
• November 2024: leaked GrayKey documents said it could get only "partial" data from iPhones running iOS 18 and 18.0.1 (404 Media).
• October 2025: someone joined a Cellebrite Microsoft Teams call and leaked a slide of its capabilities against Google Pixel phones, which also mentioned Pixels running GrapheneOS (404 Media).
• July 2026: GrapheneOS said recent Cellebrite Premium documentation shows no exploit for locked GrapheneOS phones updated past a 2022 patch level, and no way around the Pixel's security chip rate limiting (GrapheneOS forum).

The pattern is consistent. Success depends on the model, the security patch level and whether the phone is in BFU or AFU state, and up-to-date phones that have been restarted are the hardest targets. Both sides change with every release, so any single support list is a snapshot.

Automatic restarts and USB protection

The iPhone timer runs inside the Secure Enclave and does not depend on the network, according to Jiska Classen's analysis. Police in the US noticed it in November 2024, when seized iPhones started restarting in storage (404 Media). Sources: Google Advanced Protection, Apple Lockdown Mode, GrapheneOS features.

When forensic tools are misused

In December 2024, Amnesty International reported that Serbian police and intelligence used Cellebrite tools to unlock the phones of journalists and activists during detentions and interviews, and then installed spyware it named NoviSpy (Amnesty). In February 2025 it documented a Cellebrite exploit chain that attacked Linux USB drivers to unlock a student activist's Samsung phone; Google fixed one of the flaws in its February 2025 security update, and Cellebrite said it had stopped "relevant customers" in Serbia from using its products (Amnesty Security Lab). A phone that was taken from you and handed back may have been tampered with; see If you suspect tampering.

What phones keep that you might not expect

• Notification history. In April 2026, 404 Media reported that the FBI recovered copies of incoming Signal messages from an iPhone's notification database, even though Signal had been deleted from the phone (404 Media). Set messengers to put no name or message text in notifications. Hiding previews on the lock screen is not the same thing.
• Photo metadata and albums. Photos record when and often where they were taken (see Metadata inside files), and deleted photos usually sit in a "recently deleted" album for weeks.
• Usage and location records. Both iOS and Android log which apps you use and, depending on settings, places you visit. Location history is covered in the metadata guide.
• Keyboards and caches. Predictive keyboards learn words you type, and apps cache images and previews outside their main database.

Desktop systems keep detailed records so that search, "recent files" lists and troubleshooting work. Forensic tools read them automatically, and most survive deleting the file they point to. Almost all of them live on the system drive, so full-disk encryption protects them while the computer is off. They are fully readable while it is on and unlocked.

Windows

• Prefetch files record which programs ran, how often and when.
• Jump lists and shortcut (LNK) files record recently opened files for each app, including files on USB sticks and network shares.
• ShellBags remember folders you opened in File Explorer, including folders on drives that are no longer connected.
• Thumbnail cache keeps small previews of pictures and videos after the originals are deleted.
• Registry and event logs record USB devices plugged in (maker, model and often serial number), sign-ins, and when the computer started and shut down.
• Shadow copies (System Restore points) can hold older versions of files you have since deleted.
• Recall on Copilot+ PCs saves a screenshot every few seconds if you opt in. Snapshots are encrypted and opened with Windows Hello, and by default they are kept until the space set aside for them fills up (25 GB on a 256 GB drive). Anyone who gets past Windows Hello as you, for example by forcing your face or fingerprint, can search everything you have looked at (Microsoft). Since May 2025, Signal Desktop on Windows 11 hides its window from Recall by default (Signal).

macOS

• The unified log records system events, including devices connected and apps started.
• A quarantine database lists files downloaded from the internet together with the address they came from.
• Screen Time and usage databases record which apps you used and when.
• FSEvents logs record files that were created, renamed or deleted, and the Spotlight search index holds the names and text of indexed files.
• Time Machine keeps local snapshots of older file versions.

Linux

• Shell history files such as ~/.bash_history record commands you typed.
• GTK desktops such as GNOME keep a recent files list in ~/.local/share/recently-used.xbel and previews in ~/.cache/thumbnails.
• The systemd journal and other logs record logins, sudo use and USB devices.
• Snapshots made by Btrfs, ZFS or Timeshift keep older versions of files.

The SANS Windows Forensic Analysis poster maps these artifacts to the questions investigators ask, such as which files were opened and which devices were connected. It is written for examiners, but it is a useful checklist of what your own computer records.

Browsers

A browser profile holds history, cookies, cached pages and images, saved form data, the downloads list and session files used to restore tabs. Private windows avoid writing history and cookies, but files you download stay, and so do traces outside the browser such as the operating system's DNS cache, swap space and Recall. Browser sync copies your profile to the provider. Google says that with a sync passphrase it cannot read your synced Chrome data; without one, it makes no such promise. See the browser guide.

Messengers

• Turn on disappearing messages for sensitive chats. They also limit what is on the other person's phone, which you do not control.
• Set notifications to show no message content (see Phones).
• Check whether chat backups are end-to-end encrypted, or turn them off. See the messaging guide.

Cloud backups: often the easiest route

Many investigations never need the phone. Apple's US legal process guidelines (October 2025) say iCloud content, including device backups with photos, app data and messages, can be handed over in response to a search warrant. With Advanced Data Protection turned on, Apple says it cannot decrypt Photos, iCloud Drive, Backup, Notes and Safari Bookmarks; Mail, Contacts and Calendars stay readable to Apple (guidelines, Apple). It is off by default, and Apple no longer offers it to new users in the UK (Apple).

Google says Android backups are partly end-to-end encrypted with your screen lock PIN, pattern or password, but photos and videos in Google Photos are not (Google). Turn on end-to-end encryption wherever it is offered, or keep encrypted backups on a drive you hold. See Cloud storage.

Files carry hidden information about how and where they were made. Phone photos record the time, the camera model and often GPS coordinates. Office documents store author and company names, edit times, comments and tracked changes. PDFs can keep earlier versions inside the file. In 2012, a photo of John McAfee published by Vice still carried location metadata that revealed where he was (Wikipedia). The metadata guide covers this in depth, and printed pages have their own problems (printer tracking).

Deleting a file normally removes its entry from the file system and marks its space as free. The data stays where it was until something else is written over it, and recovery tools can often rebuild whole files from the leftovers. Copies may also exist in journals, snapshots, backups, the cloud provider's "recently deleted" folder and the thumbnail and preview caches described above.

Hard drives versus SSDs and flash

On a spinning hard drive, overwriting a file's location generally destroys it, and one pass over the whole drive is generally considered enough; NIST describes multi-pass schemes as past practice (NIST SP 800-88 Rev. 2). SSDs, USB sticks, memory cards and phones work differently. Their controller writes new data to fresh cells to spread wear (wear levelling) and keeps spare capacity you cannot address, so the old copy can survive an overwrite.

A 2011 study that read SSD flash chips directly found that none of the tested single-file erasure techniques worked, that overwriting the entire drive twice was usually but not always enough, and that built-in sanitize commands worked but were sometimes implemented incorrectly (Wei et al., USENIX FAST 2011). TRIM, which tells an SSD which blocks are no longer in use, often makes deleted files unreadable through normal means, but BleachBit's documentation notes it is not guaranteed to be immediate or complete (BleachBit docs).

While a computer is on, its memory (RAM) holds the disk encryption key, open documents and passwords. Memory does not clear instantly when power is cut: researchers led by Princeton showed in 2008 that it keeps its contents for seconds at room temperature and much longer when chilled, enough to recover disk encryption keys (Halderman et al.). An examiner who seizes a running computer may try to capture its memory before switching it off.

• Sleep keeps the disk unlocked. Microsoft notes that resuming from sleep does not ask for the BitLocker PIN, and advises hibernating or shutting down before a device leaves your control (Microsoft).
• Swap, page and hibernation files are copies of memory on disk. They are protected only if they sit on an encrypted drive. With BitLocker on the system drive, Windows keeps them there by default.
• Use a pre-boot PIN or passphrase. Unlocking automatically with the TPM chip alone means the key is loaded into memory without you.
• Tails overwrites memory at shutdown, including when you shut it down in an emergency by pulling out the USB stick (Tails).

System cleaners delete browser data, caches, temporary files and some of the operating system records listed above. That is useful hygiene, for example to stop old history piling up or before lending a computer to someone. They cannot reach cloud copies, backups or other devices, they cannot reliably erase anything on an SSD, and the fact that a cleaner ran can itself be recorded.

Before selling, recycling or returning a device, erase the whole thing rather than individual files. The US government's guideline, NIST SP 800-88, was revised in September 2025. It distinguishes clear (overwriting through normal commands), purge (methods that defeat laboratory recovery, such as the drive's own sanitize commands and cryptographic erase) and destroy. It warns that multi-pass overwrites give very little protection on SSDs, that degaussing does not work on flash, and that sanitize commands require trusting the manufacturer's firmware (NIST SP 800-88 Rev. 2).

Cryptographic erase destroys the key that encrypts a drive instead of overwriting the data, which takes seconds. Modern phones and Macs rely on it: Apple says erasing the key "renders all files cryptographically inaccessible" (Apple). It is only as good as the encryption underneath, and a 2018 study found serious flaws in the built-in encryption of many SSDs (Meijer and van Gastel). If you encrypted the drive yourself from the start, destroying your own key is a crypto-erase you control.

The anti-forensic measures that hold up are preventive: encrypt everything, keep sensitive work on systems that do not write it to disk, and make phones fall back to their locked state quickly. These three tools are covered in more depth in the disk encryption and operating systems guides.

Forensic methods also work for you. If a phone was taken at a border, a police station or by someone close to you and later returned, it may have been copied or had software installed, as in the Serbian cases above. Do not try to analyse it on your own if you are at real risk. Civil society groups can get free help: Access Now's Digital Security Helpline answers around the clock in several languages, and Amnesty's Security Lab runs forensic checks for journalists and activists. Apple sends threat notifications to users it believes were targeted by mercenary spyware, and Android's Advanced Protection can keep tamper-resistant intrusion logs for later analysis.

United States. Courts disagree on whether the Fifth Amendment protects you from being forced to unlock a device. In April 2024, the Ninth Circuit held in United States v. Payne that forcing a person's thumb onto a phone was not testimonial, so the Fifth Amendment did not apply (opinion). Revealing a passcode generally gets more protection, though some courts allow it to be compelled. The EFF concludes that fingerprints are less secure than passwords, both legally and technically (EFF).

United Kingdom. Under section 49 of the Regulation of Investigatory Powers Act 2000, police and other authorities can serve a written notice requiring you to make encrypted data readable or, in some cases, hand over the key. Knowingly failing to comply can mean up to two years in prison, or five in national security and child indecency cases.

Elsewhere, rules vary widely, and border searches often follow different rules from ordinary police searches. Check the law where you live and where you travel, and talk to a lawyer if you expect to be searched.

• Encrypt every device before you put sensitive data on it, with a long passphrase and a pre-boot PIN on computers. See Disk & file encryption.
• Power off phones and computers when they may be taken, for example before a border crossing, a protest or leaving a hotel room. A phone that was switched off or restarted stays in its most protected state until you unlock it.
• Use a long alphanumeric passcode and turn off fingerprint and face unlock in risky situations.
• Turn on the automatic restart and USB protections your phone offers: Advanced Protection on Android 16 and later, Lockdown Mode on iPhone if you face targeted attacks, or GrapheneOS.
• Keep notification content out of the system. In Signal and other messengers, choose to show no name or message text.
• Decide where your backups go. Turn on end-to-end encrypted cloud backups or keep encrypted local ones, and know what each app uploads.
• Clean files before you share them with mat2, Metadata Cleaner or Scrambled Exif, then check the result with ExifTool.
• Use Tails for work that should leave no trace on a computer, and restart it between unrelated tasks.
• Leave Recall off on Copilot+ PCs, or remove it in "Turn Windows features on or off".
• Erase whole devices, not files, before disposal, using the method that matches the hardware.

• Trusting the Recycle Bin or Trash. Emptying it marks space as free; it does not overwrite the data.
• Shredding files on an SSD and assuming they are gone. Wear levelling can keep old copies out of reach of any shredder.
• Leaving a laptop asleep instead of off. The disk is unlocked and the key is in memory.
• Forgetting the cloud. Deleting a photo from the phone does not delete it from a synced library or last night's backup.
• Forgetting the other end. Messages you deleted still exist on the recipient's phone and in their backups.
• Relying on hidden lock-screen previews. The message may still be stored in the phone's notification database.
• Running cleaners just before a search. The cleanup is visible, and in many countries it can be treated as destroying evidence.
• Selling a phone without signing out and resetting it, or a PC whose drive was only reformatted, not sanitized.

• NIST SP 800-88 Rev. 2: Guidelines for Media Sanitization (2025)csrc.nist.govClear, purge and destroy, and why overwriting is not enough for flash storage.
• Wei et al.: Reliably Erasing Data From Flash-Based Solid State Drivesusenix.orgThe 2011 study behind most advice on SSD erasure.
• Jiska Classen: Reverse engineering iOS 18 inactivity rebootnaehrdine.blogspot.comHow the iPhone's 72-hour restart works and why it matters for BFU and AFU.
• GrapheneOS: protections against data extraction from locked devicesdiscuss.grapheneos.orgRate limiting, auto-reboot, USB controls and the duress PIN, explained by the developers.
• Amnesty International: Cellebrite zero-day used against a Serbian activistsecuritylab.amnesty.orgA detailed case of a forensic tool exploiting a locked phone through USB.
• SANS: Windows Forensic Analysis postersans.orgThe Windows artifacts examiners check, grouped by question.
• Apple: Legal Process Guidelines (US)apple.comWhat Apple can hand over from iCloud, with and without Advanced Data Protection.
• Halderman et al.: Lest We Remember, cold boot attacks on encryption keysusenix.orgThe 2008 paper showing that memory keeps its contents after power-off.
• EFF: Digital Privacy at the U.S. Bordereff.orgCompelled unlocking, powering devices off and what border agents can do.