2-Minute Tip #7: Get Ahead of App Deletion

Messaging apps like Signal, Telegram, and Snapchat are designed to erase or encrypt data.

Once messages vanish, they are rarely recoverable—even with a forensic image.

📌 Practical Action:

• Ask clients early what apps were in use and whether anything relevant happened there.

• Use tools that can extract volatile data before it’s lost, such as Cellebrite UFED or GrayKey, when available.

• Send account preservation letters to Apple, Facebook, or other cloud-linked services—even if the content originated in a secure messaging app.

NEW!

Our next tip will go over retaining an expert for your investigation. See more at the Digital Evidence Toolbox.

Have a case with digital evidence? Contact us at IRIS LLC to get our help.