Practical Mobile Forensics - Fourth Edition

Understanding techniques to recover deleted files from the SD card and the internal memory

Data recovery is one of the most significant and powerful aspects of forensic analysis. The ability to recover deleted data can be crucial to crack many civil and criminal cases. From a normal user's point of view, recovering data that has been deleted would usually refer to the operating system's built-in solutions, such as the Recycle Bin in Windows. While it's true that data can be recovered from these locations, due to an increase in user awareness, these options don't often work. For instance, on a desktop computer, people now use Shift + Delete as a way to delete a file completely from their desktop.

Data recovery is the process of retrieving ...