Many Android phones, as investigators noted, can also be automatically reset after trying too many incorrect passwords, Carney added. — Reuters
After authorities seized Fort Bend County Judge KP George's cell phone last month, investigators alleged the judge may have attempted to delete all the information from the device before handing it over.
In a seizure warrant for his devices, Texas DPS investigators alleged the judge may have tried to reset his Android cell phone as officers were serving the warrant.
George's cellular devices were seized Sept 18. According to the warrant, investigators saw George "manipulating his phone" before the device was taken. Upon opening the phone, investigators said they discovered that the device had 15 unsuccessful passcode attempts.
Samsung devices, according to investigators in the court document, will factory reset, or clear all data and settings from a device, after 20 failed passcode attempts. A forensic expert said this week that if such an attempt was made to reset the phone or delete its contents, the data would likely still be available to investigators.
George did not immediately respond to requests for comment.
Representatives from the Fort Bend County District Attorney's Office said they were unable to comment due to pending litigation.
Here's what to know about information stored on cell phones and whether authorities can still access the information after it has been deleted.
What is a factory reset?
There are multiple ways to attempt to clear data from a phone, said John Carney, a digital forensics examiner who is also a licensed federal attorney. Users can manually delete data like text messages, or they can do a factory reset through its control settings.
Many Android phones, as investigators noted, can also be automatically reset after trying too many incorrect passwords, Carney added.
A factory reset is intended to return the phone to its "original condition right from the box," Carney said, which will clear settings and some data.
Does a factory reset clear all evidence on a phone?
Factory resets remove about 40% of data from a phone, Carney said, but forensic specialists can still retrieve about 60% of that deleted information.
The reason, he said, is that factory resets are rarely ever completely successful due to slight aberrations across device systems.
"It's really hard for one basic set of software code to be able to do a factory reset on all these different kinds of hardware," Carney said. "In my experience when you do a factory reset on an Android, there's a possibility that quite a bit of the evidence will not be erased or wiped because of the inability of that software to optimally perform the erasure operation."
What can police find on a phone?
Forensic examiners can recover most information that's been deleted from a phone, but law enforcement can pull even more information, Carney said.
Investigators can issue warrants to Internet service providers, social media platforms, data storage clouds, applications and other "third party data" through the Electronic Communications Privacy Act, according to the US Department of Justice.
Once police have a warrant for a phone, it is unlikely that any data will completely "disappear" after deletion or a reset, Carney said.
"Law enforcement will have the capabilities to unlock a phone because they have the finest tools in the business," he said. "These highly advanced tools allow them to unlock any device, whether it's an Android or an iPhone."
Are there any risks to attempting a reset?
Attempting a factory reset on a phone before its seizure is risky in and of itself, Carney noted.
If attorneys can prove a factory reset was intentional, a judge may call for an "adverse inference," whereby the judge will instruct jurors to "assume the worst" about what the phone could have possibly contained, Carney said.
"In other words, you should take the worst possible assumption about what the content of the phone could have been, which is a double whammy," he said.
In essence, a jury would be instructed to assume that the phone contained incriminating evidence and form their decisions accordingly. – Houston Chronicle/Tribune News Service
