root@mhfh:~# ./recover --target=I02 --priority=high

Phone Forensics for Infidelity Cases — Recover Deleted Cheating Evidence

When a phone is in your hands and the law is on your side, deleted does not mean gone. We perform full filesystem acquisition on iOS and Android, carve SQLite freelists, decrypt vault apps, and produce a court-grade forensic report.

Stop using the device. Every minute of normal use overwrites recoverable deleted content.

#Mobile Forensics#Infidelity#SQLite#Chain of Custody#Court Evidence

[ REQUEST FORENSIC ACQUISITION ][ READ THE TECHNIQUE ]

What Actually Survives Deletion on a Modern Phone

The single most-believed myth in mobile forensics is that 'deleting a message' destroys it. In reality, almost every messaging app on iOS and Android stores its data inside a SQLite database, and SQLite — by design, for performance reasons — almost never overwrites a deleted record. Instead it marks the row as free space. That free space is then reused only when the database next needs to grow into the same offset, which on a heavily used phone can take weeks, on a lightly used one years.

There are three forensic strata where deleted content commonly lives. The Write-Ahead Log (WAL) holds transactions that have not yet been committed back into the main database file. On WhatsApp, iMessage and Signal, the WAL routinely contains the last 7–14 days of deleted messages in fully readable form. Recovery from the WAL is fast, reliable and requires nothing more than sqlite-utils or a Python script.

The freelist sits one layer deeper. Every SQLite database keeps an internal index of pages that have been freed by deletion but not yet reallocated. Carving these pages with tools like undark, sqliteparser or our in-house mhf-sqlite-carve recovers the bulk of historical messages — typically months back, sometimes more than a year. The records come back with their full schema, including timestamps, sender IDs, and attachment hashes.

Below the database lives the unallocated space of the filesystem itself. This requires a full physical acquisition (checkm8 on supported iPhones, EDL on Qualcomm Android, fastboot+TWRP on unlockable devices) and yields the most opportunistic recoveries — sometimes nothing, sometimes a perfect screenshot of a conversation the partner thought they had wiped two years ago. This is also where we recover deleted media: photos, voice notes, video — often with intact EXIF.

Forensic Methodology for Infidelity Cases

Infidelity cases hold a particular evidentiary risk: the very emotional weight that motivates the engagement is the same weight that makes opposing counsel attack the chain of custody. We therefore apply criminal-grade methodology even though the case is civil.

Phase 0 — authorisation. We will not touch a device without proof of standing: ownership of the device, joint ownership, court order, or written authorisation from the registered user. The authorisation document becomes evidence-item-zero in the case file.

Phase 1 — preservation. The device arrives in a Faraday bag and is photographed in situ before power state is changed. Battery percentage, IMEI, model, OS version, and lock state are documented. If the device is unlocked, we immediately disable auto-lock and increase the timeout — turning it off may trigger BFU (Before First Unlock) state, which dramatically reduces what is extractable on iOS.

Phase 2 — acquisition. We aim for the highest tier the hardware permits: physical (full filesystem) > advanced logical > logical. iPhone 6–X devices are typically taken to physical via checkra1n. iPhone XS through iPhone 14 are handled via Cellebrite Premium or Elcomsoft's agent-based extraction. Recent Pixel and Samsung devices are extracted via fastboot+EDL with vendor-specific shims. Each acquisition is hashed (SHA-256) at three checkpoints — pre-acquisition, post-acquisition, and post-analysis.

Phase 3 — analysis. Acquired images are mounted read-only. We run iLEAPP (iOS) or ALEAPP (Android) for the standard parsers, then layer in custom carving for the apps relevant to infidelity: WhatsApp (msgstore.db + WAL + freelist), iMessage (chat.db + sms.db merged), Telegram (cache4.db with E2EE-secret-chat caveat), Snapchat (arroyo.db + scoped-storage media), Tinder/Hinge/Bumble (per-app SQLite caches and Photo cache directories), and the major vault apps (Calculator+, KeepSafe, Best Secret Folder).

Phase 4 — report. The deliverable is a written forensic report that names the analyst, lists every tool and version, hashes every artefact, and presents the recovered content in a narrative timeline. Where requested, we attach an affidavit and offer expert-witness testimony.

tools/phone-forensics-infidelity_methodology.sh

AES-256 SECURED

# Acquisition checkpoint hashing
$ shasum -a 256 case-042-pre-acq.img > hashes/pre.sha256

# WAL recovery — last 7-14 days of deleted WhatsApp messages
$ sqlite3 msgstore.db "PRAGMA journal_mode=WAL; PRAGMA wal_checkpoint(TRUNCATE);"
$ sqlite-utils dump msgstore.db messages --json > recovered_wal.json

# Freelist carving — months of historical deletes
$ python3 mhf-sqlite-carve.py --db msgstore.db --out ./carved/
$ undark -i chat.db -o carved_imessage.csv --freespace --unallocated

# iMessage merged view (sms+imessage on iOS)
$ python3 imessage_extractor.py --db chat.db --out ./imessage_full.html

# Final integrity check
$ shasum -a 256 case-042-post-analysis.img > hashes/post.sha256
$ diff hashes/pre.sha256 hashes/post.sha256   # MUST be identical

Phone Forensics for Infidelity Cases — Recover Deleted Cheating Evidence forensic workstation — // fig.2 — operator workstation during phone forensics infidelity

Decrypting Vault Apps & Hidden Photo Stores

Vault apps are the single biggest evidence reservoir in a 2026 infidelity case. They disguise themselves as calculators, weather widgets, file managers and even system utilities. Behind a PIN, they hold hidden photo libraries, chat exports, and entire parallel address books. The vendors market them explicitly to the cheating market — though the App Store and Play Store listings phrase it as 'protect your privacy from prying eyes'.

The good news for forensics: most consumer vault apps roll their own crypto rather than using the platform's keystore, and they tend to do it badly. We routinely extract the underlying SQLite database and the AES key from the same APK or IPA, then decrypt the entire vault contents in seconds. Apps in this category include Calculator+ (HiCalculator), Best Secret Folder, KeepSafe (older versions), Vaulty, and Calculator Vault.

On iOS, the additional surface is the Notes app's password-protected notes, the Files app's hidden directory, and — most importantly — the Photos app's Hidden album. The Hidden album is not encrypted; it is merely filtered out of the default view. A simple toggle in Settings → Photos exposes everything in it. Many cheating partners do not realise this and use the Hidden album as their primary vault.

Hands-On Tutorial: First-Hour Triage Before Calling a Forensic Lab

When you have legitimate access to the device and time pressure (a partner returning home, a custody hearing in 48 hours), the first hour matters more than the next week. Run this triage before requesting a full lab acquisition — it preserves evidence and often surfaces enough on its own to decide whether full forensics is needed.

Photograph the device in its current state, both sides, with timestamp
Put the device in airplane mode, then disable Wi-Fi and Bluetooth separately
Disable auto-lock (Settings → Display → Auto-Lock → Never on iOS)
Check Photos → Albums → Hidden — capture screen recordings, do not delete
Check Settings → Notes → Password — note whether locked notes exist
Check Files → Browse → On My iPhone for unfamiliar folders
Open Settings → Screen Time → See All App Activity (last 7 days, by app)
Take a fresh encrypted iTunes/Finder backup before handing off to a lab

tools/phone-forensics-infidelity_diy-tutorial.sh

AES-256 SECURED

# After encrypted backup is taken, decrypt it for analysis
$ mvt-ios decrypt-backup -p "PASSWORD" -d ./decrypted ./Backup/

# Pull every messaging-app database for triage
$ find ./decrypted -name 'chat.db' -o -name 'msgstore.db' -o -name 'cache4.db'

# Quick deleted-message peek (iMessage)
$ sqlite3 ./decrypted/.../chat.db \
    "SELECT datetime(date/1000000000+978307200,'unixepoch'), text \
     FROM message WHERE is_from_me=0 ORDER BY date DESC LIMIT 50;"

# Quick deleted-photo recovery from Hidden album
$ find ./decrypted -path '*PhotoData/MISC*' -name '*.JPG'

Evidence Handling, Chain of Custody & Court Admissibility

A forensic acquisition that cannot survive cross-examination is worse than no acquisition at all — it telegraphs to the opposing party that you have evidence while simultaneously preventing you from using it. We follow the ISO/IEC 27037 chain-of-custody standard on every infidelity engagement, the same standard used in criminal computer forensics.

Every artefact is hashed at acquisition with SHA-256 and a secondary BLAKE3 hash. Every analyst who touches the evidence signs an access log. Every tool used is recorded with its version number and license fingerprint. The final report includes a sworn statement from the lead analyst attesting that the evidence has not been altered between acquisition and disclosure.

Where a case proceeds to court, we make the lead analyst available for deposition and trial testimony as part of the engagement fee. We have testified in family court, civil court, and arbitration proceedings. The single most common challenge from opposing counsel is the authorisation chain — which is why phase zero of every engagement is the ironclad documentation of the client's standing to authorise the acquisition.

root@mhfh:~# man phone-forensics-for-infidelity-cases-—-recover-deleted-cheating-evidence --faq

Frequently Asked Questions

It depends on usage. WAL recovers the last 1–2 weeks reliably. Freelist carving commonly reaches 6–18 months. Anything older requires unallocated-space recovery and is opportunistic — sometimes years come back intact, sometimes nothing.

For modern iPhones, yes — we strongly prefer the passcode because it enables AFU (After First Unlock) extraction. We can sometimes work around it on older hardware via checkm8, but the result is more limited and the timeline is longer.

If we receive the device and return it without restoring use during the engagement, no. We work from a forensic copy and never touch the live device beyond acquisition.

In most jurisdictions, forensic acquisition of a device where you have technical or legal standing is fully standard. We require verification of standing before any work begins to ensure all engagements align with our professional operational protocols.

$ ls -F ./related-recovery/