Before discussing recovery of deleted data from an electronic device, it is essential, at the very least, to mention the discipline that deals with this operation: the so-called digital forensics.

It processes digital data of any kind for the purpose of detecting computer evidence reproducible in court.

The legal principles of digital forensics were defined in 2001 with the Budapest Convention on Cybercrime, adopted a few years later in Italy with the Law of March 18, 2008, No. 48.

Previously, forensic computing was regulated by Law 547/1993 (“Modifications and additions to the rules of the penal code and the code of criminal procedure regarding computer crime”).

Data, even if deleted, is not permanently removed and can be recovered even after a long time, unless overwritten.

Private investigators can play a crucial role in recovering such data.

However, it is essential that at the time of data acquisition, these are not altered, otherwise they cannot be used in a potential trial.

How does the recovery of deleted data work?

Investigators use sophisticated technological tools while scrupulously adhering to best practices international standards to access the unallocated areas of digital devices.

This allows them to recover previously deleted data.

However, the success of the recovery depends on various factors:

  • type of device: some devices lend themselves more easily to recovery than others;
  • operating system: procedures may vary depending on the operating system;
  • deletion method: the type of deletion (normal, formatting, overwriting) drastically affects recovery;
  • time elapsed since deletion: the more time passes, the less chance of success.

Tools and methods for data recovery

Here are some of the most commonly used tools by private investigators for data recovery:

  • Cellebrite's UFED device;
  • software Oxygen Forensics.

Conclusions

The recovery of deleted data requires specific skills and availability of professional equipment.

Private investigators, with their experience and tools, can help recover valuable information that would otherwise be lost.

The AIRO Private Investigations Institute, with its experience in the field of digital forensics, offers its services to clients to recover deleted data that can be used in court.


Such activity can only be carried out on devices owned and exclusively used by the customer and not by third parties.

Contact us