A few weeks ago, I spoke to a tech at BlackBag, and he said essentially the same thing randomaccess said. The files are individually encrypted, and when they are deleted, the encryption key is deleted. So, although the data likely still exists, without the encryption key, you're not getting that data back.
That actually led to my decision to not buy Cellebrite UFED at this time because it's $10,000 that gets me very little extra over what BlackLight can already do on an iPhone.
I've had luck pulling deleted SMS and MMS messages because those are stored in an SQL Lite database and it is (currently) not flushed as often as Apple would like you to believe.
↧