Now, this one is fun.
This is a good situation.
So in a Vegas classroom, I had a student who did not
believe me on that last slide.
He felt that was absolutely ridiculous.
There's no way.
So he raised his hand.
I was like, let's try it.
This is actually screenshots from his device.
He went through and deleted a whole bunch of things.
And he's like, OK, I'm going to delete all these text messages.
He did an iTunes backup that he encrypted, and parsed it,
and said, look, Heather.
I have all my messages.
And I was like, no way--
not possible.
So I did it on my test device, and I had no messages.
However, if you look at this, he had 476, and he deleted 322.
I had 10 messages.
So that night, while playing blackjack,
I was thinking about this.
And I was like, I wonder if he had Wi-Fi turned on.
I wonder if it takes a period of time for it
to sync to cloud before it actually vacuums that database.
So the next morning he comes in-- so you see this is 9/11.
He comes in on 9/12.
I ask him to delete more and dump his phone again.
Look at the difference--
down to 13 messages.
So all those were purged.
So this means you have a period of time before it will catch up
and vacuum that database.
Putting the device in airplane mode
will not protect from vacuuming, but it will
prevent from syncing to cloud.
So if the sync the cloud is what triggers a vacuum,
you could potentially get it--
meaning, if you walk in right now,
and I'm under investigation, and you see me massively deleting
data, acquire it immediately.
Make sure you encrypt that backup
to see if you can get some of these deleted artifacts.