Can police be able to recover a video permanently deleted from an iPhone?

Yer_Man wrote:

In some circumstances it might be possible, but it would be expensive, and time consuming, and uncertain. They would need the decryption key for the device along with the hope that it has not been overwritten to such an extent that all that is left is fragments.

I wouldn't expect that to happen here, or anywhere outside of a lab for that matter.

Flash storage doesn't work and doesn't do data remanence at all similarly to how HDDs work.

With flash storage, if somebody were to halt all storage activity immediately after the deletion and interrupt the storage queued for erasure and re-use, and go fetch some exceedingly expensive hardware to scan the storage in the queue for erasure, sure, there might be some fragments of previous contents. But by the time this question was even posted, that deleted photo or video data has already been erased.

Flash storage necessarily has to erase each sector before that storage can be re-written and re-used, so deleting the file (and releasing that storage for re-use) necessarily causes the contents of that storage to be re-assigned elsewhere and erased.

Because the erasure process is slow as compared with read and write, the erasure happens shortly after the data is freed from its last use, and then made available for re-use.

In desktops and such using SSDs, this erase-before-use process is known as TRIM.

Modern flash storage also use over-provisioning and wear-leveling, which means you can't reliably overwrite the sectors short of heroic efforts or erasing the whole device—each time you write to a (logical) sector, you get the next available physical sector, wherever that might be. But again, the flash storage must be overwritten before reuse. (HDDs use over-provisioning and replacement re-vectoring on errors too, but typically not wear leveling. And not erasure prior to re-use, absent storage or controller or host operating system support for that.)

SSDs and flash storage do not work like HDDs.

Nothing is ever "permanently deleted" from the internet or even your device by conventional means. thats why there are all manner of data recovery software available that can and do recover "permanently" deleted files every day. . If those pictures were not sent through external file erasure software, then they are still stored on that hard drive. You may have tried deleting files permanently using Shift + Del key, emptying the Recycle bin, or tried formatting the system or external hard drive. Of all these methods, none can make your file gone forever. They only make the file inaccessible. Not even Apple devices are exempt from this fact.

When you permanently delete a file, the storage drive makes its space available for new data. However, the file is not deleted. It remains on the hard drive; only the file pointers get deleted. (The File pointer shows you where the file exists and keeps track of it being accessed.) It means that the deleted file is not gone; it just became inaccessible.

Even Cmd Opt Del does not permanently erase anything.

You can buy software to truly overwrite the files to 0s and 1s, but the short answer to your question is "yes". If it is important enough to them for whatever reason, we can have a device sent off to recover deleted data unless it has been professionally wiped from existence.

pantelis134 wrote:

Will the police be able to recover a video permanently deleted from an iPhone?

Permanently deleted photos and videos are permanently deleted.

If the photos and videos are not still in the Recently Deleted album, and were not previously stored or copied or archived elsewhere, then those photos and videos are permanently deleted.

In this case, permanent does actually mean permanent.

a_r_kitekt wrote:

When you permanently delete a file, the storage drive makes its space available for new data. However, the file is not deleted. It remains on the hard drive; only the file pointers get deleted. (The File pointer shows you where the file exists and keeps track of it being accessed.) It means that the deleted file is not gone; it just became inaccessible.

Not true for the iPhone or any device using an SSD drive. The SSD drive that uses TRIM technology such as the iPhone does not work that way at all. In order for a SSD drive to make storage available it must first erase the data that is stored there. When a file is deleted by the user, the TRIM command gathers up all of the pages/blocks and erases the data so it can be used again. In no way does it work like a HD that simply marked the space as available in the drives directory sector and kept the data in place until it was overwritten.

In some circumstances it might be possible, but it would be expensive, and time consuming, and uncertain. They would need the decryption key for the device along with the hope that it has not been overwritten to such an extent that all that is left is fragments.

I wouldn't expect that to happen here, or anywhere outside of a lab for that matter.

It was that exception I was thinking of, as I pointed out

it might be possible, but it would be expensive, and time consuming, and uncertain.

You just put it a lot more technically, but that knowledge is your burden not mine

:)

a_r_kitekt wrote:

You can buy software to truly overwrite the files to 0s and 1s, but the short answer to your question is "yes". If it is important enough to them for whatever reason, we can have a device sent off to recover deleted data unless it has been professionally wiped from existence.

That’s how hard disks work, yes. Flash-based storage works fundamentally differently.

pantelis134 wrote:

Will the police be able to recover a video permanently deleted from an iPhone?

They can't even open a locked iPhone without the owner providing them the passcode, so I would not expect them to be able to recover a permanently deleted video.

Very interesting!