A laptop gets wiped so it can go to a new hire. A phone gets reset before it is traded in. Someone deletes a folder "to tidy up" after a dispute starts. Then, weeks later, that device turns out to matter.
These are usually honest mistakes. But in digital forensics, what happens to a device before an examiner sees it can shape what is still there to find. Here is why, what to do instead, and what a forensic exam can and cannot recover afterward.
Why "cleaning up" a device can hurt a case
Phones and computers are constantly writing new data: app updates, logs, caches, syncs and new messages. When files are deleted, remnants can sometimes remain until that space is reused. Ongoing use, a factory reset or a wipe can overwrite those remnants.
Changes made after a matter begins can also raise questions about who did what and when. Even well-meant steps can make the timeline harder to establish.
What preservation means
Preservation means protecting the device and its data in the state they are in, and documenting that. In a forensic engagement, that typically includes:
- Intake — the device is logged and chain of custody begins.
- Document — condition, settings and identifying details are recorded.
- Protect — the device is isolated from changes where appropriate.
- Copy — a forensic copy is made so analysis does not alter the original.
- Analyze and report — findings in plain language, with exhibits as needed.
Our digital forensics work applies this to computers, external media and cloud accounts. For phones and tablets, see mobile and email forensics.
What to do before anyone touches the device
If a phone, computer or account could matter to a dispute, an HR issue or a legal matter:
- Stop using it for new activity where practical.
- Do not factory-reset, wipe, reimage or reissue it.
- Do not delete, move or "organize" files or messages.
- Avoid having staff or family "take a look around" first.
- Note passcodes you know, and whether biometrics are enabled.
- Keep a phone powered and charged if possible.
- Write down who has had the device and when.
- Work through counsel when the matter is in litigation.
What if it has already been reset or cleaned up?
It is not always a lost cause. Depending on the device, its software and what happened, some data may still be recoverable, and related evidence may exist elsewhere, such as cloud accounts, email, backups or other devices. An examiner can tell you what is realistic after understanding the situation.
What a forensic exam cannot do
A careful exam has limits. It cannot recover data that was overwritten or never stored, reverse strong encryption without credentials, or guarantee that every deleted file still exists. It also cannot undo changes made before preservation, though it can often help document them.
When the other side has produced findings, our role may be to review them and explain what they do and do not show — work that sits alongside expert testimony and litigation support.
Remote collection when travel is not practical
Devices and custodians are not always near our office. For multi-location or multi-state matters, we can often collect evidence remotely while keeping it court-ready. See remote evidence collection.
For examples of how we handle real matters, see our case studies.
Frequently asked questions
Can I just make my own backup instead? A home backup may help preserve some data, but it is not the same as a forensic copy with chain of custody, and it may not capture everything an examiner looks for. Ask before relying on one.
Should IT reimage the laptop of a departing employee? If there is any chance of a dispute, consider preserving it first. Reimaging can be hard to undo.
Is it OK to look through the device myself? Browsing can change data and timestamps. It is usually safer to preserve first and review the copy.
Talk to an examiner
If a device might matter to a case, or you are unsure whether to preserve it, call us before anyone wipes or reissues it. Every conversation is confidential.
- New York: 631-982-4632
- Boca Raton, FL: 561-391-6057
- Hours: Monday–Friday, 9 AM–5 PM ET
- Request a confidential consultation
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on October 24, 2026.