I am sending my phone in to a forensic specialist to do a physical acquisition to help me prove that my text messages were deleted by law enforcement when the phone was in their possession. My concern is that since the phone has graphene os on it, the deleted text messages will be zeroed from memory and there will be no way for me to prove that this action has been done. The phone is still in airplane mode when I received it from them. It's hard to tell exactly what has been done to it since they have had in their possession for 10 months. I do have counsel, but like I said I am sending it in to a forensic analyst who will do a physical acquisition to tell me exactly what is going on. Any help from anyone would be great.

    I don't believe that GOS will be the determining factor here. If the device was actually wiped, as in restored to factory defaults, the data is likely lost due to Android's native filesystem encryption. Wiping the device would essentially reset the encryption key. If the text messages were simply deleted while the rest of the OS was left intact, you may have a chance of recovery. I am by no means a security expert, but that would be my understanding.

    Were they SMS messages? I think most all/carriers are forced to log all sms sent/received. Ask a lawyer to subpoena the carrier to provide the messages.

    the phone was unlocked when they took possession.

    Police wipe information what proofs your innocent sounds like a unbelievable story...BUT I believe you since it happened before here in my country and actually now we can see they do it with the SkyEcc and Encro evidence before show the judge who just accepts this unfair game. Lucky the EU Court of Justice department do follow the law and tell them at last they need to show all the evidence, like GPS location what could show that the suspect wasn't there.
    If law enforcement cross the law, the only difference between criminals is that they have a badge.
    I hope you can success finding your things to proof your innocent, good luck!

    2 months later

    bacongrease Your forensic expert was able to get deleted things from your phone ?

      bacongrease

      This would fall under data recovery from storage device. When data is deleted the space allocated to the data is made available to be overwirtten. When an operating system is on and active, it continuously writes new data the drive as part of its background operations. This data might be small but it is written to available space, therefore there is a chance it might overwrite any deleted data and cause the permanent loss of that data. As such the data will become unrecoverable. This process is a bit different between SSDs and HDDs but also similar. Therefore it is very important not to use the device or turn it on, so to protect the deleted data on the drive.

      In the case of android, i don't know how much data it writes in the background. Might be less than desktop, but you really should keep the phone totally off if you want to do any data recovery. Don't use the phone at all.