Recover Deleted iPhone Photos: The Honest Version

The question of whether deleted iPhone photos can be recovered has one honest answer: it depends entirely on what state the photo is in. Conflating three different states is where dishonest tools and overhopeful claims go wrong. Sherlock Forensics iPhone Analyzer handles each for exactly what it is.

Hidden photos are not deleted at all. They are moved to a hidden album, still fully present on the device, so Sherlock surfaces them plainly. Recently Deleted photos sit in a holding album for roughly 30 days before iOS clears them; while they remain they are recovered in full with their metadata. Purged photos, past that window and cleared from the library, are the hard case: what survives then is only what freed-page carving can pull from the database before those pages are reused. Naming the state is the first honest step; the recovery claim follows from it.

The photo library is tracked in SQLite databases, the same structure that holds messages and calls. When a photo record is deleted, iOS marks its database page as free rather than erasing it on the spot. Until the database writes new data over that page the deleted record is physically still there. Sherlock carves those records back out through standard freed-page carving, the same methodology it applies across the iOS artifact set.

What survives is a function of time and device use after the deletion, not a tool setting. A photo deleted and purged an hour before acquisition on a lightly used phone is often recoverable; the same photo deleted months ago on a busy device has usually been overwritten and is gone. This is physics that applies to every forensic tool equally. What separates a credible one is that it recovers what is actually there, flags it as recovered and reports honestly on the rest rather than fabricating records to look thorough.

One nuance worth understanding is that carving often recovers the record before it recovers the pixels. A carved database row can return a photo's filename, its capture timestamp, its GPS coordinates and its album membership even when the underlying image file itself has already been reclaimed. For an investigation that is frequently enough: the fact that a photo with a specific timestamp and location once existed on the device and was then deleted can be the material point in itself, regardless of whether the image ever renders. Sherlock presents the recovered record and whatever media survives with it, staying explicit about which of the two a given result is, so an examiner never implies a picture exists when only its metadata came back.

Recently Deleted media, hidden albums and freed-page carving all work from an encrypted logical backup as well as a full-filesystem extraction, so deleted-photo recovery does not require enterprise acquisition tooling. Point Sherlock at a backup you make from an unlockable device, an existing iTunes or Finder backup or a Cellebrite UFED or VeraKey full-filesystem extraction. A full-filesystem extraction reaches deeper into hidden and deleted media that a logical backup does not carry, but the core recovery is available whichever way the evidence arrived.

A deleted photo is often most useful for more than what it depicts. Recovered media carries its capture GPS and EXIF where present, so a photo comes back with the time it was taken and, frequently, the place. That turns a single recovered image into a dated whereabouts point that plots on the offline map and feeds the merged Activity Timeline alongside messages, locations and app activity. In many matters the metadata on a deleted photo settles a timeline question the image itself only hints at.

The same honesty applies to the metadata as to the pixels. Sherlock reports the capture data the file actually carries and does not infer a time or place that is not recorded. A recovered photo without embedded location is presented as exactly that, a photo without a recorded place, not a gap the tool papers over.

The single most important discipline in deleted-media evidence is keeping recovered items visibly distinct from live ones. Sherlock flags every carved and Recently Deleted item as recovered in the interface and in the court report, so an examiner never presents a carved photo as a live one and can testify precisely to each item's state. Analysis is 100 percent read-only; the evidence is never modified.

The court-ready HTML report documents case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice.

Sherlock recovers what the evidence still holds: Recently Deleted and hidden media present in the backup or extraction, along with records carved from freed pages that have not been overwritten. It does not recover photos the device has already purged and overwritten, does not reconstruct an image from nothing and does not reach iCloud Photos that never synced to the device. It reads a device you can unlock, an existing backup or a Cellebrite UFED or VeraKey extraction. The honest limit is the product: a straight account of what survived is worth more in court than an inflated promise.

Download the free edition, open a backup or extraction and see the Recently Deleted, hidden and carved media in your own evidence for yourself. Unlock the full recovery when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: iPhone forensics fact checks · iMessage forensics · Significant Locations forensics · Product page