What if you have a wiped device and the user did not set it
up and start using it again?
What can you do?
Chances are good if it's file-based encryption
on an Android or if it's full disk encryption before it
was wiped or if it's an iPhone, you're
not going to recover anything because the master key is over
in an iPhone.
Everything goes into encrypted and allocated space.
On Android, if it's encrypted, when it's wiped--
also encrypted unallocated space.
But you could try.
If you have an older device, you could carve,
you could use bulk extractor.
But what if just portions of it were overwritten,
and you're looking to see if anything exists?
So in Autopsy for free, you can do keyword searching,
you can do PhotoRec Carver and have
it carve things in the background,
and Cellebrite, with the Magnifying Glass,
you can do regular expressions.
You could do RegEx and GREP and do
anything you want to see what you can uncover.