Forensic Data Recovery: Deleted Texts, Photos & Files
The honest 2026 reality of what can actually be recovered from your iPhone, Android, computer, or external drive, what cannot, and the recovery sources almost everyone overlooks.
The Honest Short Answer
Modern smartphones and SSD computers have made on device recovery of deleted data significantly harder than it was even five years ago. Encryption, TRIM commands, and aggressive storage management mean that once something is truly deleted, it is often electrically gone. But that does not mean recovery is impossible. The real win comes from knowing where else the data lives: iCloud and Google backups, Recently Deleted folders (30 day window), thumbnail caches, notification artifacts, app caches, system snapshots, and external storage. We find every recovery source available and tell you straight what we can and cannot get back. Flat fee engagements typically run $1,000 to $5,000.
Most data recovery websites lead with promises. Recover anything. Recover everything. Recover what you thought was gone forever. Some of that was true 10 years ago. Most of it is no longer true in 2026, and any firm that promises miracle recovery on a modern iPhone or a TRIM enabled SSD is either lying, uninformed, or selling you something else entirely.
This page is going to be honest with you instead. We will tell you what can usually be recovered, what cannot, and where the real recovery opportunities actually live in 2026. That honesty matters because the difference between "this is recoverable" and "this is gone" usually depends on small details: how long ago it was deleted, what device, what operating system, whether cloud backup was enabled, and whether you stopped using the device before calling us.
If you are reading this because something important just got deleted, scroll to the bottom of this page or call us now. Every hour matters. If you are an attorney or HR manager trying to understand what we can actually do for a case, keep reading. The full picture is more useful than the marketing version.
Stop Using the Device. Call Us Now.
Every minute of continued use reduces what we can recover. Free 15 minute scoping call. We will tell you honestly whether recovery is possible before you spend anything.
Contact Elite Digital Forensics → Or call now: (833) 292.3733 · ConfidentialWhy Modern Recovery Is Different
Two technologies fundamentally changed data recovery over the last decade, and the public has not really caught up to the implications.
Encryption. Every modern iPhone, every Android phone running Android 10 or newer, and every modern Mac with an Apple Silicon chip uses hardware level encryption by default. Files are not just deleted, they are deleted and the encryption keys protecting them are rotated, which means even if a forensic examiner can read the raw flash memory, what they get back is mathematically indistinguishable from random noise.
TRIM. Solid State Drives (SSDs) use a function called TRIM that proactively erases deleted data blocks within seconds of deletion. TRIM has been enabled by default in Windows 7 and newer, macOS Yosemite and newer, and all modern Linux systems. On a TRIM enabled SSD, deleted files are not "hidden, waiting to be recovered." They are electrically erased from the NAND flash chips. The data is gone in a physical sense, not just a logical sense.
What this means in practice: the "scan your drive for deleted files" approach that worked great on spinning hard drives in 2010 does not work on most modern devices. Recovery in 2026 is less about reading raw storage and more about finding every place the data was copied to before it was deleted: cloud backups, local backups, snapshots, thumbnails, caches, and system level artifacts.
The good news: most people have more copies of their data scattered across more places than they realize. The recovery rate when all those sources are systematically checked is often higher than people expect, even when the original device cannot give us anything.
Device by Device: The Real Recovery Picture
Here is the honest reality for each major device type in 2026. Skip to whichever applies to your situation.
iPhone & iPad Recovery (iOS 17, iOS 18, iOS 26)
What is usually recoverable
- Recently Deleted items. The Messages app holds deleted texts for 30 days. The Photos app holds deleted photos and videos for 30 days. The Files app holds deleted files for 30 days. Notes has a Recently Deleted folder. If the user has not manually purged the Recently Deleted folder and 30 days have not passed, the data is usually retrievable in minutes.
- iCloud backups. If iCloud Backup was enabled before deletion, the deleted content almost certainly exists in a prior backup. Apple keeps the most recent backup plus typically the previous two or three.
- iCloud Photos library. If iCloud Photos was on, deleted photos persist in iCloud Recently Deleted for 30 days, and prior synced versions may exist in shared albums or device backups.
- iTunes / Finder local backups. Anyone who has ever connected their iPhone to a computer for backup has likely created a local backup that may contain deleted content.
- Thumbnail caches. The iOS PhotoData folder retains small thumbnail versions of photos in iThmb files. These often survive deletion of the full resolution original and can prove that an image existed on the device.
- Notification database artifacts. In some cases, message content from apps like Signal, WhatsApp, and iMessage persists in the iOS notification database even after the source message is deleted. Apple has patched some of these gaps in 2026, but the artifacts often remain in prior backups.
- App specific caches. WhatsApp, Telegram, Signal, and other messaging apps often maintain their own local caches that survive longer than the user expects.
What is usually NOT recoverable
- Texts and iMessages deleted more than 30 days ago with no iCloud backup. The SMS database vacuums itself quickly, and on modern iPhones the deleted message records are not recoverable from the device itself even with a full file system extraction. This is the most painful conversation we have with clients and the one that most catches people off guard.
- Photos deleted more than 30 days ago with no iCloud Photos or local backup. Sometimes thumbnails survive, but the full resolution originals are usually gone.
- Anything deleted before the device was factory reset. A factory reset rotates the encryption keys. Everything that existed before the reset is mathematically irretrievable from the device, period.
Android Recovery (Android 13, 14, 15, 16)
What is usually recoverable
- Google account backups. If the user had Google backup enabled, contacts, messages (varies by manufacturer), call logs, app data, and photos sync to Google servers. This is often the single best Android recovery source.
- Google Photos. If Google Photos backup was on, deleted images persist in Google Photos Trash for 60 days and may also exist in shared albums.
- Manufacturer cloud backups. Samsung Cloud, Xiaomi Mi Cloud, and OnePlus backups frequently contain content the user does not realize is being backed up.
- App specific cloud sync. WhatsApp Google Drive backups (created weekly or daily for many users), Telegram cloud chats (stored on Telegram servers), Signal cloud backups, etc.
- External SD cards. Photos, videos, and downloaded files stored on an SD card are often unencrypted (depending on settings) and recoverable using traditional file system carving techniques.
- Logical extraction artifacts. Even on FBE encrypted devices, a logical extraction (when we have the passcode or the device is in an unlocked state) can recover deleted items still indexed in the file system or cached by apps.
What is usually NOT recoverable
- Physical level recovery from FBE encrypted devices. Android 10 (2019) made File Based Encryption mandatory. On modern Android phones, the deleted content on the physical flash chips is encrypted with rotating keys, which means raw chip off recovery yields encrypted noise rather than data.
- SMS and MMS deleted from many Android devices with no cloud backup. Unlike iCloud, Google does not back up SMS by default on all manufacturer skins, which means deleted texts on stock Android often have no cloud safety net.
- Anything deleted after a factory reset. Same encryption key rotation issue as iPhone.
Windows Computer Recovery
What is usually recoverable
- Recycle Bin items. Files in the Recycle Bin are fully recoverable until the bin is emptied. Many users forget this is the first place to check.
- Thumbcache files. Windows automatically generates thumbnail previews of images, videos, and documents and stores them in thumbcache_32.db, thumbcache_96.db, thumbcache_256.db, and thumbcache_1024.db files in the user AppData folder. These thumbnails often persist long after the original file is deleted and can prove that specific images existed on the system, which is invaluable in many investigations.
- OneDrive version history and recycle bin. Files synced to OneDrive can often be recovered from OneDrive Recycle Bin (30 days) or restored from prior versions.
- Volume Shadow Copies and System Restore points. Windows often retains snapshots of system state that include user files. These can be a goldmine.
- Microsoft 365 / Outlook recovery. Deleted emails and calendar items can usually be recovered from the deleted items folder, recoverable items folder (server side), or from prior mailbox backups for up to 30 days.
- Files on traditional spinning hard drives. Older laptops and desktops with HDDs (not SSDs) still allow classic forensic file carving from unallocated space. Deleted files persist until overwritten, which can be weeks or months in many cases.
- External USB drives and SD cards. Often the best recovery target because TRIM is rarely passed through USB connections, so deleted files persist on the storage media.
What is usually NOT recoverable
- Files deleted from a modern Windows laptop with an SSD. Once TRIM has run (usually within seconds to minutes of deletion), the deleted file data is electrically erased from the NAND flash chips and cannot be recovered by any forensic tool. The thumbcache and backup sources above become the only recovery path.
- Files where the user emptied the Recycle Bin and ran a "secure delete" utility. These tools overwrite the data multiple times with random patterns. Recovery is impossible.
- BitLocker encrypted drives where the user has forgotten the password. Recovery requires the BitLocker key, which we cannot brute force in any reasonable time frame.
Mac Computer Recovery (macOS Sonoma, Sequoia, Tahoe)
What is usually recoverable
- Trash contents. Until emptied, the Trash is the first stop.
- Time Machine backups. Probably the single best recovery source on a Mac. Time Machine retains hourly, daily, and weekly snapshots of the file system going back as long as the backup drive has space. If the user had Time Machine running, the deleted files almost certainly exist in one of those snapshots.
- APFS local snapshots. Even without an external Time Machine drive, macOS automatically creates APFS snapshots locally. These are often overlooked and frequently contain recoverable user data going back days or weeks.
- iCloud Drive trash and version history. Files synced to iCloud Drive remain in iCloud Recently Deleted for 30 days. Many file types also support version history.
- QuickLook thumbnails. Similar to Windows thumbcache, macOS generates and stores thumbnail previews of media files that can persist after the originals are deleted.
- Mail message recovery. Apple Mail keeps prior versions in Trash, and IMAP based email accounts (Gmail, Outlook, iCloud Mail) usually retain server side deleted folder copies.
- Photos Library Trash. Deleted photos remain in the Photos Library Recently Deleted album for 30 days.
What is usually NOT recoverable
- Files deleted from a modern Mac with Apple Silicon and no Time Machine or snapshots. APFS combined with SSD storage and TRIM means the deleted file data is electrically erased quickly. Recovery requires finding the data in a backup source rather than on the drive itself.
- Files where the user used Secure Empty Trash on older macOS versions, or any third party secure deletion tool. These tools overwrite data and prevent recovery.
- FileVault encrypted drives where the password is unknown. Same situation as BitLocker. Recovery requires the recovery key.
External Drives, USB Flash Drives & SD Cards
External storage is frequently the best recovery target in 2026, and most clients are surprised by this. The reason is straightforward: most external storage does not implement TRIM through USB connections, and many flash drives and SD cards do not implement TRIM at all. That means deleted files persist on the storage media until physically overwritten by new data.
What is usually recoverable
- Deleted files from USB flash drives until overwritten. Often weeks or months of history depending on usage.
- Deleted photos and videos from SD cards. Camera SD cards, phone SD cards, and dashcam SD cards often retain deleted content for extended periods.
- Deleted files from external spinning hard drives. Same as internal HDDs, deleted file content persists until overwritten.
- Formatted drives. Quick format on most external drives leaves the underlying data intact and recoverable.
- Damaged drives. Even physically damaged drives can often be recovered with specialized tools, depending on the failure mode.
What is usually NOT recoverable
- External SSDs connected to a system with TRIM passthrough enabled. Rare but increasingly common on newer hardware and OS combinations.
- Drives that have been heavily overwritten with new data since the deletion.
- Drives that have been physically destroyed or had their controller chip catastrophically failed.
The First 60 Minutes Are Everything
If you have just lost something important and you are reading this trying to figure out what to do, here is the short version. Hand this to anyone else involved.
Do This Immediately
- For a phone: enable airplane mode immediately. Stop using the device. Do not log in, do not send messages, do not take photos. Background sync and app activity actively overwrite recoverable data.
- For a computer: stop using it. Save no new files, install no software, run no disk utilities. Every write reduces what we can recover.
- For an external drive or SD card: disconnect it. Do not plug it back in to "check if it still works."
- Check the Recently Deleted folders first. Photos, Messages, Files, Notes, Mail, Trash, Recycle Bin. The fix you need might be 30 seconds away.
- Check your cloud accounts. iCloud, Google account, OneDrive, Dropbox, iCloud Photos, Google Photos. Look in trash folders within each.
- Document what you remember about the deletion. When did it happen? How? Was sync running? What was the device doing? These details help us scope recovery.
- Call a forensic firm if the above does not solve it. The longer you wait, the worse the recovery odds get.
Do NOT Do This
- Do not install data recovery software on the affected drive. The installation itself can overwrite the data you are trying to recover.
- Do not run "deep scan" recovery tools repeatedly hoping for better results. Each scan can modify the drive.
- Do not factory reset the device. This rotates the encryption keys and makes recovery from the device itself essentially impossible.
- Do not pay an online "recovery service" $700 to "recover your deleted texts" without verifying that recovery is technically possible for your specific situation. Many of these services collect payment and produce nothing because the data is genuinely unrecoverable.
- Do not assume any retention rule applies to your case. Verify. Apple, Google, and carriers all have specific data retention policies that change over time.
- Do not continue using the device while you wait to call us. We mean this. The most expensive mistake in data recovery is the "I just want to check one thing" moment.
The Most Common Recovery Killer
Continued use of the device after the deletion. The phone stays on, apps keep syncing, the operating system keeps writing logs, photos and messages keep coming in. Every one of those writes can overwrite the unallocated storage blocks that held the deleted data. The single most valuable action you can take is to stop using the device and call us within minutes, not hours.
Tell Us What Happened. We Will Tell You Honestly What Is Possible.
15 minutes on the phone with a certified examiner. No retainer, no payment, no obligation. We will tell you whether recovery is technically possible and what it would cost before you decide anything.
Schedule a Recovery Consultation → Or call now: (833) 292.3733Common Recovery Scenarios We Handle
The same handful of situations come up over and over in our intake calls. Here is what they actually look like in practice and what we typically do:
| Scenario | Typical Approach | Typical Cost |
|---|---|---|
| Deleted text messages on an iPhone (custody, infidelity, workplace) | Check Recently Deleted, iCloud backups, iTunes backups, notification artifacts | $1,500 to $3,000 |
| Deleted photos and videos from a phone or camera | Recently Deleted folders, iCloud or Google Photos, thumbnail recovery, SD card carving | $1,000 to $3,000 |
| Accidentally deleted business files from a Windows or Mac computer | Recycle Bin, Time Machine, Volume Shadow Copies, OneDrive history, Trash | $1,500 to $4,000 |
| Employee data theft investigation with deleted evidence | Full forensic exam, recovery from unallocated space and thumbcache, USB transfer analysis | $3,500 to $10,000 |
| USB flash drive or SD card appears empty or corrupted | File system reconstruction, file carving, partition table recovery | $1,000 to $3,000 |
| Deleted emails for legal or HR matters | Server side recovery, archived backups, local PST/OST file analysis, retention policy review | $2,000 to $6,000 |
| Damaged or failing hard drive with critical data | Imaging in clean room conditions, controller repair, sector by sector reconstruction | $2,500 to $8,000+ |
| Court ready forensic report documenting recovery process | Add to any of the above when admissible evidence is required | +$500 to $1,500 |
Every quote starts with a free scoping call. We tell you what we can and cannot get back before you commit to anything.
When Recovery Is Genuinely Impossible
We are going to be straight with you about this because nobody else will: sometimes the data is gone. Not retrievable, not buried somewhere clever, not waiting to be unlocked. Gone. The situations where this is true:
- The device has been factory reset and there are no backups, no synced cloud accounts, and no other copies. The encryption key rotation makes the data mathematically gone.
- The data was deleted more than 30 to 60 days ago from a modern smartphone with no cloud backup ever enabled and no local computer backup. The Recently Deleted window is closed and the device level recovery options are exhausted.
- An SSD with TRIM enabled had the file deleted, the Recycle Bin emptied, and significant new activity occurred on the drive. The blocks are electrically erased and there is no recovery technology that brings back data from erased NAND cells.
- A "secure delete" or "wipe" utility was used. These tools overwrite the data multiple times specifically to prevent recovery.
- The storage media has been physically destroyed beyond what clean room reconstruction can recover.
When we determine recovery is not possible, we tell you immediately and we do not charge you for the determination. The free scoping call exists specifically to prevent clients from spending money on impossible engagements.
When You Need a Court Ready Report
If the recovered data needs to be admissible in court, used in arbitration, or produced in regulatory proceedings, the recovery engagement requires additional rigor. Specifically:
- Chain of custody documentation from the moment we receive the device until final disposition
- Forensically sound acquisition using write blockers and validated imaging tools (Cellebrite, Magnet AXIOM, FTK, EnCase) so the original evidence is preserved unaltered
- Hash verification proving the working copy is mathematically identical to the original
- Written expert report documenting exactly what was recovered, from where, by what process, and with what limitations
- Examiner availability for deposition or trial testimony at standard expert witness rates
These engagements bill at the upper end of the flat fee range or hourly depending on scope. The cost is small compared to the consequence of evidence being excluded for lack of proper handling.
For more on expert witness work in digital forensics, see our Expert Witness Pricing Guide. For corporate matters involving employee data theft or workplace investigations, see When to Hire a Digital Forensics Firm for an HR or Corporate Investigation.
Frequently Asked Questions
Can deleted text messages be recovered from an iPhone in 2026?
Honestly, usually not from the device itself. Once a text message is deleted from the Messages app and removed from the Recently Deleted folder (30 day window), it is generally not recoverable from the device, even with a full file system extraction. The SMS database vacuums itself quickly and modern iOS encryption prevents the kind of physical recovery that used to work on older phones. Recovery is possible from three other sources: iCloud backups taken before the deletion, iTunes or Finder backups on a connected computer, or in some cases system level notification artifacts that retain message fragments. The fastest way to know is a free 15 minute scoping call.
Can deleted photos be recovered from an iPhone?
Yes, often. The Recently Deleted folder in the Photos app preserves deleted photos for 30 days. After that, three recovery sources remain: thumbnail caches stored in the PhotoData folder (small versions of deleted images that often persist), iCloud Photos backups, and iTunes or Finder local backups. Recovery from the device itself after the 30 day window is increasingly difficult on modern iPhones due to encryption and storage management.
Can deleted data be recovered from an Android phone?
It depends heavily on the Android version and what was deleted. Since Android 10 (2019), File Based Encryption (FBE) is mandatory, which makes physical level recovery of deleted user data essentially impossible without the device passcode. Recovery is possible through logical extraction (recovering data still indexed in the file system), cloud backups (Google account, app specific cloud sync, Samsung Cloud), and in some cases external SD cards that may not have been encrypted. App caches and thumbnails sometimes preserve evidence of deleted content.
Can deleted files be recovered from a computer SSD?
Usually no, especially on modern systems. Solid State Drives (SSDs) use a function called TRIM that permanently erases deleted data blocks within seconds to minutes of deletion. TRIM has been enabled by default in Windows 7 and newer, macOS Yosemite and newer, and all modern Linux distributions. Once TRIM runs, the data is electrically erased from the NAND flash chips and no recovery is possible. Recovery is possible from external USB SSDs where TRIM is not always passed through, older systems with TRIM disabled, and from backup sources (cloud backups, Time Machine, system restore points, OneDrive, iCloud Drive).
Can deleted files be recovered from a USB drive or external hard drive?
Often yes, and these are frequently the best recovery targets. External USB drives, flash drives, SD cards, and traditional spinning hard drives generally do not implement TRIM aggressively (or at all over USB connections), which means deleted files often remain physically present on the storage media until overwritten. Recovery success depends on how much new data has been written to the drive since the deletion. Stop using the drive immediately if you need to recover data from it.
How much does forensic data recovery cost?
Most forensic data recovery engagements at Elite Digital Forensics fall between $1,000 and $5,000 as a flat fee, depending on case type, number of devices, volume of evidence, and complexity. Single device recovery for a defined scope often runs $1,000 to $2,500. Multi device recovery or cases involving cloud account collection plus a written expert report typically run $3,000 to $5,000. Complex matters with expert testimony bill hourly at $300 to $500 per hour.
What is the recently deleted folder and how long does it keep deleted items?
Most modern operating systems and apps include a Recently Deleted feature that holds deleted items for 30 days before permanent deletion. iPhone Photos: 30 days in Recently Deleted. iPhone Messages: 30 days in Recently Deleted (introduced in iOS 16). iPhone Files: 30 days. iCloud: 30 days. Google Photos: 60 days. Android Messages: varies by manufacturer. Windows Recycle Bin: until manually emptied. macOS Trash: until manually emptied. Once an item passes the Recently Deleted window or is manually purged, recovery becomes significantly harder and often requires forensic intervention.
How quickly should I act if I need to recover deleted data?
Immediately. Every hour reduces recovery success. For mobile devices: enable airplane mode and stop using the device, which prevents background sync from overwriting evidence. For computers: stop using the drive completely, do not install recovery software on the affected drive, and do not run any disk utilities. For external drives: disconnect immediately. The single biggest factor in recovery success is how much new activity has occurred since the deletion.
The Bottom Line
Forensic data recovery in 2026 is less about miracle technology and more about systematic, honest investigation of every place the data might exist. Sometimes that means the device itself. More often, it means cloud backups, snapshots, thumbnails, caches, and the dozens of other places modern operating systems quietly copy your data without you knowing.
The firms that promise miracles are usually the ones that deliver nothing. The firms that tell you the honest reality, including when recovery is impossible, are the ones who actually find what is there. That is the standard we hold ourselves to, and that is why our scoping calls are free and our recovery quotes are flat fee whenever possible.
If something important just got deleted, the next move is the same regardless of device: stop using it, and call us. The faster we look, the more we find.
Court Qualified. Transparent. Free Initial Consultation.
30+ years combined experience. iPhone, Android, Mac, Windows, external drives. Flat fee engagements typically $1,000 to $5,000 depending on case type, number of devices, volume of evidence, and complexity. Court ready reports available. NDAs available before conflict check.
Contact Us. Start Your Recovery → Or call (833) 292.3733 · Daytona Beach, FL · Serving Nationwide