(copyright Steve Burgess 2026)
One of my favorite client conversations goes something like this:
Client:
“I deleted it.”
Attorney:
“Can you get it back?”
Forensic examiner:
“…define ‘it.’”
Television has taught us two completely opposite and equally wrong ideas:
- Deleted means permanently destroyed forever.
OR
- Digital forensics can recover anything short of a laptop being launched into the Sun. And once we make a spacecraft capable of diving into the corona…
Reality, as usual, lives in the awkward middle.
When people delete data, they’re often removing references to the data—not instantly vaporizing every underlying bit.
That’s why deleted material can sometimes remain recoverable.
But—and this is the part TV skips—not always.
Recovery depends on things like:
• what device it was on
• what app created it
• what happened afterward
• syncing behavior
• encryption
• elapsed time
• whether storage has been reused
And occasionally, the answer is simply: no.
I know – not nearly as dramatic as enhancing a reflection from somebody’s sunglasses. Which usually just turns out to be an image of you snapping the photo.
One of the most useful questions an attorney can ask early isn’t:
“Can you recover deleted data?”
It’s:
“What are the conditions that would make recovery possible?”
That changes the conversation from magic to evidence.
It also helps set expectations for clients.
I’ve had many, many cases where deleted evidence became central.
I’ve also had matters where the deletion itself ended up being more informative than the missing content. Spoliation, anyone?
Either way, certainty usually arrives later than a story on the Internet suggests.
And no forensic examiner should be promising miracles in the first phone call.
Question for attorneys:
Have you had a case where the existence—or absence—of deleted data changed strategy?