The Definitive Guide for Recovering Deleted Data From iPhone

Ever feel the immediate wave of regret that accompanies deleting data on accident?

For those unsuspecting users, retrieving deleted text messages or files from an iPhone can be a frustrating experience. At Secure Data Recovery, we receive countless cases and requests to reclaim deleted data from iPhones. Whether data is accidentally deleted by the user, compromised by malware, or destroyed in an update, users want solutions. And, while users or services can salvage certain situations, nothing can resolve other cases. Recovering lost text messages or data can be complicated and unclear, given the differences between various iPhone and iOS versions.

Yet few consumer electronics have revolutionized their respective industries like Apple’s iPhone. Released in 2007, the original iPhone reinvented the smartphone, delivering a device that married form and function. From the start, Apple integrated the iPhone into a seamless platform of products, cementing its status as a leader in the emerging smartphone market.

More than a decade later, the iPhone is still thriving, accounting for over half of smartphone users in the United States. And, though Apple stopped reporting iPhone sales in late 2018, insiders estimate that the tech giant has surpassed 2 billion units worldwide since its inception.

And the iPhone continues to evolve.

To that end, Apple issues major releases annually for its mobile operating system, iOS. These updates contain dozens of new or improved features. In particular, Apple often emphasizes its enhancements in privacy and security.

While most individuals share those priorities, there have been repercussions for users.

In 2014, Apple introduced Data Protection to the iPhone as part of iOS 8. Data Protection supplies users with built-in, high-level encryption, preventing their data from being accessed by unauthorized parties, including Apple. The controversial architecture led to a series of public disputes between Apple and law enforcement agencies around the globe. As a result, people overlooked one consequence of Data Protection.

Recovering data from an iPhone became almost impossible.

But users are not quite powerless.

The Design of Apple’s Data Protection

Regardless of its role in complicating most data recoveries, Data Protection is an efficient design.

Data Protection is activated when the user sets their iPhone’s passcode. At that point, applications that store or transmit sensitive data, like Contacts, Messages, Photos, or Health, are safeguarded. Applications remain interactive and responsive for the user while providing real-time protection on the backend.

Apple achieves protection by building a hierarchy of keys on industrial-grade encryption hardware. The hardware, known as the AES Engine, is embedded between the iPhone’s flash storage and RAM. This deliberate positioning enables the AES Engine to encrypt files as they are written and decrypt files as they are read without exposing keys to the processor.

However, most of Data Protection’s implementation comes from creating and managing unique keys, often linked by the hardware’s identifier and the user’s passcode.

Once the iPhone creates a file, an algorithm wraps it in a file system key. It is simultaneously assigned a class key. Each class offers different levels of protection, but the premise is similar.

Encryption occurs on a per-file basis.

When the iPhone opens one of its files, the file system key decrypts its metadata and reveals the wrapped per-file key. The class key unwraps the per-file key, then provides it to the AES Engine. From there, the AES Engine decrypts the file’s contents, allowing the user access.

These methods secure the user’s data while at rest, in transit, and in use.

And Apple’s robust, multi-layered strategy does not stop there.

In addition to the above technologies, the iPhone utilizes crypto-shredding to protect data after deletion. Crypto-shredding is the practice of intentionally overwriting all encryption keys. The crypto-shredding process is comprehensive and irreversible, rendering the data inaccessible to all, including the user.

Without those keys, data recovery engineers cannot decrypt the file’s contents, even if they could recover from the unallocated space.

How to Retrieve Deleted Text Messages on iPhone

The iPhone stores Messages app data in an SQLite database. Deleted data in an SQLite database remains within that database for a period of time. Because rather than overwriting the data, SQLite assigns it to an unused page, known as a freelist. In this state, the data is recoverable.

But there are two crucial conditions to recovering deleted data from a freelist.

One, the SQLite database cannot have been defragmented or vacuumed. In that case, the iPhone will not have much retrievable data, even with low-level forensic tools. Each application has different programming related to its SQLite databases, so the cleanup frequency varies.

The second condition is that these recoveries are limited to text.

Before iOS 12, data recovery services could retrieve iMessages, deleted text messages (SMS), and other data.

In iOS 12, Apple pivoted to a non-standard implementation that wiped data from the SQLite database instead of orphaning it in a freelist. The change occurred alongside a push for optimized performance in Messages. With regular defragmenting and vacuuming, Apple sought smoother operations for the application. But, as a result, conventional techniques could not recover Messages from iOS 12 through iOS 15.

That changed again with the introduction of iOS 16.

Recovering Deleted Text Messages with the Messages App

With iOS 16, Messages data survives a month after deletion. To access and restore deleted messages:

1. Open the Messages app from the iPhone’s Home screen.
2. Tap Edit in the top-left corner of the Messages screen.
3. Press Show Recently Deleted in the pop-up menu.

4. Select the relevant conversation(s).
5. Press Recover in the bottom-right corner.

6. Tap Recover Message(s) for the number of recoverable messages from the conversation.

The Messages app is the most straightforward method of recovering messages.

Users cannot retrieve deleted data from Messages if 30 days elapse, or they purge the files from Recently Deleted.

Recovering Deleted Text Messages with iCloud Backup

Those with iOS 15 or older versions can still restore deleted iPhone text messages.

Without Recently Deleted, users can lean on their iCloud backup to restore old messages.

Using iCloud, users can access their files across Apple devices and create backups at 24-hour intervals when connected to a power source and Wi-Fi. Apple offers a free version of iCloud that supports basic backups of 5 GB. For an additional fee, users can upgrade to iCloud+, where subscribers can receive up to 2 TB of storage for more advanced backups.

With an iCloud backup, users can restore their iPhones to a prior point. If the last backup predates deletion(s), restorations can retrieve multiple files that are otherwise lost. These files include deleted text messages and data from third-party applications.

To check if the last backup occurred before deletion(s):

1. Open the Settings app from the iPhone’s Home screen.
2. Tap the Apple ID profile at the top of the Settings screen.

3. Select iCloud to show its status.
4. Tap iCloud Backup.
5. Check the last successful backup.

If the last successful backup predates deletion(s), proceed with the following steps on iOS 16:

1. Open the Settings app from the iPhone’s Home screen.
2. Scroll down and select General.

3. Scroll down and tap Transfer or Reset iPhone.

4. Select Erase All Content and Settings at the bottom of the screen.
5. Tap Continue.
6. Enter the appropriate passcode when prompted.
7. Select Erase Now. Do not elect to back up before erasing. Doing so will overwrite the previous backup.
8. Follow the on-screen instructions until the Apps & Data screen appears.
9. Tap Restore from iCloud Backup.
10. Sign in to iCloud with the appropriate Apple ID when prompted.
11. Choose the most recent backup that precedes deletion.

Choosing the most recent backup that precedes the deletion(s) is essential.

It is essential to choose the most recent backup that precedes the deletion(s). Older backups will be missing newer data saved to the iPhone since the backup’s creation. In that situation, users will have to assess the value of the deleted texts against the value of the data they would lose by restoring the backup.

Users may have to sign in to all of their accounts again if they opt to restore their deleted iPhone messages through this method.

Recovering Deleted Text Messages with Finder

If those approaches have not worked, users can attempt to recover messages through Finder on their Mac. This method requires the user to regularly synchronize their iPhone with their Mac.

Before beginning, users must disable Apple’s Find My iPhone feature. To disable:

1. Open the Settings app from the iPhone’s Home screen.
2. Tap the Apple ID profile at the top of the Settings screen.
3. Select Find My.
4. Toggle Find My iPhone to Off.
5. Enter the appropriate Apple ID password to confirm the setting change.

Now, to retrieve messages on Macs running macOS Catalina or later:

1. Open Finder on the Mac.
2. Connect the iPhone to the Mac with a USB cable.
3. Select the iPhone once it appears under Locations.
4. Click Manage Backups.
5. Choose the backup where messages were already sent but not yet deleted.
6. Click Restore iPhone.
7. Keep the iPhone connected until after it restarts and the syncing is complete.

It might take some time for Finder to finish the restoration process.

Recovering Deleted Text Messages with iTunes Backup

An iTunes backup is an alternative to Finder. This method can work for users with a Mac running macOS Mojave and earlier or a Windows computer. But, like Finder, an iTunes backup requires the user to have already initiated a backup to their computer. Moreover, the user cannot sync the devices since the deletion, as iTunes only stores the most recent backup.

To retrieve messages with an iTunes backup:

1. Connect the iPhone to the computer to launch iTunes.
2. Click on the Device icon near the top-left corner of the screen.
3. Navigate to the Summary page under Settings.
4. Click Restore Backup.

Follow the on-screen instructions and wait for iTunes to restore the iPhone’s data.

Other Options for Recovering Deleted Text Messages

Many suggest data recovery software as an option for retrieving iPhone text messages. While there is no shortage of software with ambitious claims, these products are often limited in their usefulness. Once data is overwritten, consumer software cannot recover messages.

Users can contact their cellular carrier to retrieve their messages as a last resort. Some carriers maintain backups of call logs and messages. Users can appeal to service providers as long as those backups are still available. Even though these attempts require authentication, users could still encounter issues in certain states due to their laws.

Recover Deleted Data from iPhone

Whether deleted data is recoverable depends on the iOS version.

Below is a table that summarizes files and the current conditions (as of December 2022) for recovering or restoring them:

Files	Current Conditions (December 2022)
Photos and Files	Can only restore within 30 days of deletion from the Recently Deleted album.
Contacts	Can recover text from SQLite database unless it has been defragmented or vacuumed.
Calendars and Notes	Can recover text from SQLite database unless it has been defragmented or vacuumed.
History (Safari)	Cannot recover deleted History since iOS 12.
Tabs (Safari)	Cannot recover deleted Tabs since iOS 12.
Bookmarks (Safari)	Cannot recover deleted Bookmarks since iOS 13.
Reading Lists (Safari)	Cannot recover deleted Reading Lists since iOS 13.
Third-Party Applications	Cannot recover deleted third-party application data.

Photos and Files

Some of the most common deleted files on the iPhone are the easiest to restore. That’s because Apple does not mark photos or videos for automatic deletion. Instead, deleted photos and videos are transferred to a Recently Deleted album for 30 days, meaning users can immediately access and retrieve their files.

To perform these actions on iOS 16:

1. Open the Photos app from the iPhone’s Home screen.
2. Tap the Albums icon on the bottom of the Photos screen.

3. Scroll down to Utilities, then choose Recently Deleted.

4. Enter the iPhone’s passcode when prompted.
5. Press Select in the top-right corner.
6. Select the relevant photo(s) and video(s).

7. Tap Recover in the bottom-right corner.
8. Confirm the selection(s) with Recover Photo.

Similar to Photos, a user can restore deleted data in the Files app. The following steps on iOS 16 can return the deleted file:

1. Open the Files app from the iPhone’s Home screen.
2. Tap the Browse icon at the bottom of the Files screen.
3. Under Locations, choose Recently Deleted.

4. Tap and hold the relevant file(s).
5. Select Recover in the menu.

Users do not have permanent access to their deleted data. After 30 days in Recently Deleted, Apple permanently deletes the files. Once that happens, the data is unrecoverable.

Contacts

The iPhone also stores the user’s Contacts in an SQLite database. As mentioned above, deleted data persists in a freelist until the SQLite database has been defragmented or vacuumed. Therefore, specialists can salvage deleted text data from Contacts as long as this condition is satisfied.

Calendars and Notes

Like Contacts, iPhones store data for Calendars and Notes in a corresponding SQLite database. And, like Contacts, their deleted data continues to exist in a freelist until the database is defragmented or vacuumed, making potential text recoveries possible.

Safari

Safari, the iPhone’s default web browser, comes with several standard features that can suffer from deletion.

History allows users to view the websites they have visited over a defined time frame. To accomplish this task, History relies on an SQLite database. However, deleted data from History met a similar fate to recent iterations of Messages. As Apple pursued performance improvements in Safari, they increased maintenance within the databases. More defragmenting and vacuuming eliminated the possibility of recovering History or Tab data from iOS 12 onward.

Deleted data from two other Safari features, Bookmarks and Reading List, became inaccessible in iOS 13.

With these changes, all deleted files from Apple’s browser are irretrievable.

Third-Party Applications

Apple assigns certain protections to users when downloading third-party applications on an iPhone. While the protections reinforce privacy and security, the applied encryption impedes any attempt at data recovery. When users delete data within a third-party application or accidentally uninstall it, engineers cannot recover the files with traditional techniques.

The Importance of iCloud Backups

The most reliable data management strategies involve proactive protection.

Frequent, thorough backup procedures can preserve data in the event of physical damage, hardware failure, or user error, such as accidental deletion.

Having an iPhone backup can save users a lot of frustration.

And Apple recognizes the value of backups.

Through cloud services like iCloud or file managers like Finder, users can create regular backups for an iPhone or iPad and protect their data at all times. An up-to-date iCloud account can even ease the transition to a new iPhone.

In December 2022, Apple announced Advanced Data Protection. The feature extends Apple’s encryption efforts to the iCloud backups stored on its servers and further insulates confidential information. Users will have to opt into Advanced Data Protection upon its full release.

Like with Data Protection, Apple cannot access encrypted backups on iCloud. Users will need their passwords to manage the account. Without a password, Apple cannot restore backups.

Conclusion

Recovering data from an iPhone, including deleted text messages, can range from simple to impossible, depending on the device and iOS version.

To restore deleted data on the iPhone, follow the steps in this tutorial.

For more complicated iPhone data recovery that might require specialized recovery tools, contact Secure Data Recovery Services for a free consultation. Our technicians are certified to recover data from Apple products. Since 2007, we have encountered and resolved thousands of data loss cases involving Apple devices. And our expertise extends to Android data recovery, which features some of the same complications and protections when recovering deleted data.

We are not limited to recovering deleted data either. Our engineers can reunite you with your lost data in most situations, including extensive component repairs. We also have experience with smartphones that have suffered severe physical or water damage.

Do not settle when the fate of your data is uncertain.

Contact the experts in phone data recovery at 800-388-1266 to begin your free consultation.