Your smartphone can store all kinds of personal data – emergency contacts, baby pictures, work schedules, and any number of things you’d hate to lose access to! But what happens if you drop your device in water, fish it out, and now it won’t power on? Or it stopped receiving a charge without being damaged at all? Suddenly you don’t have access to this information even though all the data is still stored on the device – it wasn’t deleted simply because the device no longer powers on.
So, that leads us to answer two major questions:
“How is the data stored?”
“How can the data be recovered?”
Data storage and encryption on mobile devices
iPhones and other Apple products store data entirely on internal device memory. NAND flash memory [a type of non-volatile storage technology that does not require power to retain data] will vary in size specific to each device, but the process of storing data itself is similar no matter which model. Prior to it being written to the internal flash memory, the data is instantly encrypted. Utilized by all latest models of Apple iOS devices, this data encryption can make data recovery significantly more difficult the more severely damaged the device.
Like iOS, more recent Android device data is encrypted – but unlike iOS, Android devices also have access to other storage types like SIM and MicroSD cards. Android devices will also allow for alternate data recovery methods, like JTAG or ‘Chip Off’.
Different types damage and data recovery methods
The difficulty, success rate, and timeline for completion on most data recoveries varies depending on one thing – severity. How simple or complex an issue affecting your device may determine if your data is recoverable, how much of that data can be recovered, and at what cost you can recover it. Some repair shops can offer a high rate of success, but it is never a 100% guarantee that all data can or will be recovered.
With most data being encrypted, the only way it can be retrieved is through the keyed-in hardware components. It is necessary to fix the essential parts of the device to achieve a pathway to the data – USB connectivity, screen touch, control, and image for password entry, as well as all power circuits functioning. (Auxiliary functions such as the speaker, Wi-Fi, and Bluetooth are not necessary to retrieve data.)
Dead Device/No Damage
When a device cannot receive a charge or power on, yet does not show signs of physical or water damage, an evaluation by a certified technician should determine which variables may be affecting the device – no image to the screen, no back light on screen, not receiving a proper connection from USB, etc. If the issue can be narrowed down, then the solution becomes a simple matter of fixing or replacing the essentials as mentioned above.
Water Damage
Type of liquid
While any type of liquid exposure has a chance to ‘water damage’ your device, liquids containing more minerals may increase the severity of said damage. Water, for instance, is a solvent to many organic and inorganic materials, thus containing numerous different types of minerals (think of tap water, salt water, et cetera). More corrosive damage could mean lower success rate, or just higher difficulty in data recovery. Again, it all just depends on severity.
Time of exposure
Any amount of time your device is exposed to liquid may affect the damage to components on your device’s logic board. While less time exposed to a liquid may increase the chance of data recovery, there genuinely is no guarantee and water damage tends to be random in its destruction. The more complex the liquid damage (i.e. – the more components needing fixed/replaced), the longer and more strenuous the data recovery becomes.
‘Chip Off’ Data Recovery
Requiring a high-level lab environment, this invasive and one-way method involves the process of removing the NAND chip from the logic board completely and exporting data from the binary files to a user-friendly viewable format. While typically a long process, a ‘Chip Off’ data recovery may still only yield pictures and videos as the result of a technician’s labor.
Joint Test Action Group (JTAG) Data Recovery
This forensics data recovery method makes it so it is not necessary for the NAND chip to be removed, but requires a technician to solder wires to the pin out data lines and connect to a software box for data extraction. It has less risk of damaging your data, due to being significantly less invasive than ‘Chip Off’, but still requires a tech to follow the process in exporting from binary files to a user-readable format. The cost to maintain licenses to this type of data extraction software (Ex: Cellebrite’s UFED series) can be very expensive.
Deleted Data Recovery
While deleted files may be inaccessible to you and are in danger of being overwritten, you can often recover them completely with professional and costly data recovery tools and scanners. The purpose of these scanners is to scour the NAND and locate any recoverable data, piecing it back together and providing it in a salvageable format.
Conclusion:
A common theme between each of these data recovery methods is that you need to know what you’re doing – they may not be particularly hard procedures, but not something I would leave to learning from watching YouTube videos (albeit a perfectly acceptable form of education these days). Local forensics teams may offer a five-day course just for the JTAG data recovery certification, but that can be thousands of dollars and pre-existing knowledge of phone disassembly, logic boards, and micro soldering is highly recommended. If your device stops working and you’re worried about retrieving your information, your best bet is to find the closest repair shop with access to these types of software and training (like GadgetGenie) and let the professionals handle it.
