Galaxy S10 Deleted messages and photos - Can I recover them?

[@forensicguy]

Was my explanation on android encryption fairly easy to understand? Comment below!

[@davidhasseloff7890]

I didn't understand one point, according to what you said, with physical extraction when a file is deleted also the key is deleted and even the unallocated space is encrypted so everything is all virtually unreadable, so how is it possibile to get a full file system extraction with deleted files? Aren't they gone? And is it possible to get a full file system without knowing the password? I was thinking that If you are on a encrypted device knowing the password to decrypt is an unavoidable step

[@forensicguy]

When files themselves are deleted, there is no recovery. But when it comes to messages and other data that’s held in each app, that data is in sql database. So only records within the data base are removed, therefore that data can be recovered from the sql itself even after deletion. The sql remains in place when you delete messages, call log, notes, etc. Each app has their own sql database. If you remove the app, only then the data is gone as it also removes the sql db

[@forensicguy]

Also, any phone with FDE can have its password bypassed using a decrypting boot loader.

[@davidhasseloff7890]

@@forensicguy So if I unistall the whole app, not the messages one by one, it's all gone? Is it correct? So basically FBE is next level encryption, fde is someway "weaker"

[@forensicguy]

Yes that’s correct. FBE is what iPhones have been using for near a decade now. Android is finally using it because it’s much more secure. Apple has gone a step further and once a message is deleted, the sql is cleared so no recovery is possible

[@THazebomb]

Can you explain what thumbnails or cache folders are when it comes to images or videos on modern androids? Also if those files are permanently deleted. Will they still be in thumbnail or cache folders?

[@sh1vu]

Sir , Please if you Could reply , As you said App stores Data In SQL Database , and even if we delete messages or photos , it’s still available on the phone storage marked as delete , waiting to get overwrite . So what if we delete the entire app , does it delete all the data , or the data is still available on the phone memory waiting to be overwritten by some other app or Data.

[@MAYANEGYPTIAN]

Wow. You rock my friend! So did I waste my money and time purchasing Dr phone ? I want to recover some videos from a galaxy s10e. They advertise that they can recover any file from a rooted device.

[@forensicguy]

Yeah, they lie :(

[@powerpixie2965]

Some of this is a little difficult for me to understand, but overall you make it easy to try to grasp it. Good job! Do you know if the iPhone 4 with iOS 7 and Samsung G S3 with Android 4.0/4.3 have FDE? So if someone other than the original user of the phones, deleted a SMS, WhatsApp message, a photo or a video from these two devices, would UFED be able to still recover them, if the original user of the phones had never set a password or PIN for the FDE? Or are these all permanently deleted? Thanks

[@forensicguy]

iPhone 4 uses FDE, and 4S uses FBE. Galaxy s3 is not encrypted

[@MindFreakWonders]

Hi, I'm working on recovery from a non-working S10e for a client of mine, for which I not only have all original parts but donor parts as well to replace anything faulty. Right now, I've come to the conclusion that the motherboard has some type of fault involving power, but I don't have the capability to diagnose and fix it (as there are several very small modules responsible for controlling power distribution across the logic board for this phone). I was either going to opt for swapping the CPU & NAND over to a new board or attempt some type of chip-off recovery. Are there ANY pointers you could give to guide me in the right direction?

[@quetzaltloani]

Great video sr. UFED is the best solution for encrypted phone i think, because work hard for update they software and support some phones with FBE encryption. Thx!

[@forensicguy]

It truly is!

[@SuperG11123]

I've been using the Canadian Samsung Galaxy S8 (SM-G950W) with the Qualcomm chip as a camera and video / voice recorder for over two years with 10's of GB of data. When my main phone died, I took the SIM Card out, put it in this device and it promptly did a Factory Data Reset (FDR) without my permission or prior knowledge (had I known I would have backed up). There are no backups, all files were on the internal storage (no SD card) and the phone was not password or pin-protected. Can I recover all my data - no SMS, just GB's of .jpg, .mp4 and .m4a's?

[@forensicguy]

There isn’t much you can do. Samsung is known for doing this when a sim is removed. The phone is encrypted and data cannot be recovered.

[@amandamitchell4779]

What is the name of the program or app you are using to do this ???????

[@KpopPianoverse]

Hi, thanks for the video. Based on your video, is it right to say that even for Android 11 (Samsung S20), once i delete photos and videos off my phone, they are unrecoverable? But only recoverable for sms/messages, etc.

[@forensicguy]

Yes sms and mms are recoverable for now until android starts to wipe the databases

[@KpopPianoverse]

@@forensicguy Thanks for the reply. Whats the reason that photos and videos arent recoverable on android after deletion? Is this something that Cellebrite cant do as of now? I thought they would be able to bypass FBE

[@forensicguy]

It’s because encryption. No tool will be able to do it ever

[@dankaslifeandtravel]

@@forensicguy until android starts to wipe the databases - when would that be? I dont understand? Can you cover SMS messages from a year ago?

[@victr127]

I dont understand how to extract all the data from an android device with FDE. The phone is on android version 9, so from my understanding, the files should be recoverable since its using FDE (and I can unlock it). However, its the extraction process that confuses me, do I need to dump the entire file system with Qualcomm Live on Cellebrite in this case? is it possible with other programs than Cellebrite? If so, will it still extract all files as effectively (because of the temporary root)? Sorry if these questions are stupid, I am new to this.

[@jvanderhorst2011]

Really nice information. thank you.

[@asil131]

Can I please ask what is the name exactly of the program I download onto the computer to do this I can not get it and where , thank you.

[@forensicguy]

Cellebrite.com

[@brianwestgate9801]

Is it possible to find a date that an Android phone has been factory reset if nothing has been loaded again after the reset.

[@forensicguy]

In some cases yes it’s possible

[@brianwestgate9801]

@@forensicguy Thanks, is it an easy job or is specialised software required. I am trying to establish whose custody the phone was in at the time of reset.

[@dankaslifeandtravel]

Also where do we download celebrate ufed app for free? What else has to be downladed? What is the second app to view the files

[@forensicguy]

Cellebrite UFED is a forensic tool and is very expensive You can mail your phone into my lab for this service My email is in the description of each video and here: [e-mail]

[@DJRaminem]

What if the device is a galaxy note 10, with a pattern lock? still any luck on accessing any data?

[@ethantohill7072]

I find this super interesting, but I'm confused as to how deleted data be recovered from a phone if TRIM is enabled? Surely if that's all been deleted, then after a while of idle time its beyond recovery, even using expert forensic gear? Am I wrong about this?

[@forensicguy]

Data such as photos and videos aren’t recoverable but other items such as chats, sms, call logs, notes, web history etc can still be recovered as those items are stored as records within sql database in the phone. So trim does it affect deleted records within the sql database.

[@ethantohill7072]

@@forensicguy I see, thanks! Is this true then also if the phone has been reset? As far as I'm aware it's truly impossible to get anything in that case?

[@forensicguy]

On newer phones that use encryption the data is gone. Older phones pre encryption, partial recovery was still possible using nand protocol on the Emmc by bypassing the internal controller of the memory chip

[@ethantohill7072]

@@forensicguy I feel a lot more comfortable about selling phones now lol! Keep up the good work man

[@forensicguy]

Glad I could help.

[@DiskTuna]

Hahaha, I recognize that where I made a video and want to add narration later where I need to wait for myself to click something .. some times about myself 'WTF are you waiting for, click it!' :-)

[@forensicguy]

Haha I know right? Longest 5 seconds ever 😆

[@KylesDigitalLab]

Can this recover a recently deleted video recorded on the S10? Also, I know Cellebrite says that they can brute-force the passcode on the S10, but I believe that was back around 2020 when they said that. Now we have Android 12 on the S10 and lots of new security updates since that claim - is it possible that the bruteforce attack has been patched out in software since then? Or is passcode bruteforcing basically unpatchable once somebody figures out how to do it? And also, if someone was to steal my phone and use Cellebrite on it, then give it back to me, would I be able to tell that they did use Cellebrite on it at one point? Or does it leave 0 traces of itself?

[@forensicguy]

I cannot answer some of these questions due NDA. But for your last question.. that depends on the type of extraction used. For the most part, no it wont be possible to tell if cellebrite was used.

[@513MRSHADOW513]

If you factory reset a Samsung galaxy s6/s7/s9/s10 can files still be recovered?

[@forensicguy]

Unfortunately no.

[@513MRSHADOW513]

@@forensicguy So, is it safe to sell a factory reset galaxy phone, without having to worry that someone might still be able to recover your deleted files?

[@forensicguy]

Yes

[@murtniway8589]

Is it possible to extract a Samsung s9+ with broken screen. Previous deleted photos and videos and chat transcriptions

[@xkeyscore1120]

So what's the best way of wiping the phone before I sell it. Encrypt it then do a hard reset. A crypto wipe? If not what software would wipe the free space of the phone? Is Ishredder any good?

[@forensicguy]

Any recent phone is already encrypted, and a factory reset would be sufficient unless it’s a really old android phone (pre android 7)

[@xkeyscore1120]

If that S10 was locked. Could you still get past it?

[@forensicguy]

If you have an unlock request, you need to email for info [e-mail]

[@cocobongo268]

Hi friend, :) Let's check this amazing video. My best regards.

[@forensicguy]

More coming soon! Just filmed one today for next week! And filming another one later today for next week.

[@umartijjani3669]

Ufed extraction not recovering cloud data on Android but only on iPhone Why please?

[@harshanisamarawickrama2209]

Chip off data recovery and Chip Swap Phones My Favourites. But This is Also Interesting. Nice

[@forensicguy]

Soon!

[@harshanisamarawickrama2209]

@@forensicguy Thanks 👍 Mr Stanko

[@TheOriginalZeppgirl]

Where is 'developer options' in settings? I can't see it, please help. I am in desperate need to recover my deleted messages in my S10.

[@forensicguy]

Tab build number 7 times under software version

[@blancagarcia8144]

how do I become your client?

[@forensicguy]

My contact info is in ever video description

[@mik-o9o]

what about samsung galaxy s20 ultra? Samsung says that they put new security chip for protection. Can we get data from encrypted s20 ultra for now? with cellebrite or another forensics tools? You can look here about new security chip :www.sammobile.com/news/galaxy-s20-security-chip-protects-against-hardware-attacks/

[@IctmacanicBangladesh]

I need this tools & knowledge pls help I am mobile Technician Bangladesh

[@ebeysrepair]

Hello bro

[@SeenOnTvSale]

where to find deleted mms messages on s9 I think my wife is hiding shit.

[@forensicguy]

I would love to help you but we don’t take infidelity cases

[@Boosted00]

6th lol

[@forensicguy]

Nice! You’ll never beat cocobongo

[@Boosted00]

@@forensicguy challenge accepted lol