Think a phone or computer holds evidence? Don't reset it.
When something goes wrong, like harassing messages, a suspected affair, a fraud, or an employee walking off with company files, it's natural to want to clean up the device or "take a quick look." People factory-reset a phone before they bring it in, run a cleanup app to "make space," or start tapping through messages to find what they need. Those steps feel useful. They can also overwrite the very data that matters most.
This article explains why that happens, and what to do instead. For a deeper look at how forensic preservation works, see our earlier guide, Before You Delete, Reset or "Clean Up" a Device.
Why a reset, a cleanup app, or poking around can destroy data
Phones and computers are always writing new information. Apps update in the background, caches refresh, and new messages arrive. When you delete a file or a message, the device often marks that space as available rather than instantly erasing every trace. A factory reset, a wipe, or a cleanup tool can then reuse that space. Once it is overwritten, the original data is usually gone.
"Taking a quick look" can cause problems too. Opening apps, scrolling through messages, or searching for files can change timestamps and logs. That does not always destroy the content, but it can make it harder to show when something happened and who did it. If the matter may go to an attorney, HR, or a court, those details matter.
None of this means you did something wrong if you already touched the device. It means the safest next step is to stop, preserve what is left, and get advice before anyone tries to "fix" it.
What to do instead
These four steps are a practical starting point for a phone, tablet, or computer that may hold evidence.
1. Stop using the device and don't delete anything.
Put it aside. Don't factory-reset it, don't run a cleanup or "optimizer" app, and don't delete, move, or tidy up files or messages. Don't reissue a work laptop to a new hire until you've decided whether it should be preserved. If you can, keep the device off the internet so it doesn't keep syncing or updating in the background.
2. Keep it charged, and write down the passcode.
A phone that dies can be harder to examine, especially if it uses encryption tied to a passcode or biometrics. Keep it powered and charged. Write down the passcode if you know it, and note whether Face ID, Touch ID, or a fingerprint is turned on. Don't try to guess or bypass a lock you don't have.
3. Screenshot important messages, but keep the originals on the device.
A screenshot can be a useful record of what you saw and when. It is not a substitute for the original messages, which often include more detail than a picture can show. Take the screenshot if you need it, then leave the messages and files where they are.
4. Talk to a forensic examiner before anyone tries to "fix" it.
A well-meaning IT person, a friend, or a repair shop can overwrite data while trying to help. Call an examiner first and describe what happened. They can tell you how to handle the device, and whether a forensic copy should be made so the original stays unchanged. Our digital forensics work covers computers, phones, email and related sources. For phones and tablets specifically, see mobile and email forensics.
Careful handling from the start gives your attorney, your HR team, or you the best chance of getting clear answers.
What if the device has already been reset or cleaned up?
It is not always a lost cause. Some data may still be recoverable, and related records may exist in cloud accounts, email, backups, or other devices. An examiner can tell you what is realistic after hearing what happened. Don't try a second cleanup to "undo" the first one.
Talk with us
If you think a device holds evidence, or you are unsure whether to preserve it, call us before anyone resets, wipes, or reissues it. Consultations are kept confidential.
- New York: 631-982-4632
- Boca Raton, FL: 561-391-6057
- Hours: Monday–Friday, 9 AM–5 PM ET
- Learn more about our digital forensics services
- Request a consultation
Executive Digital Group is a women-owned business founded by Tiffany Graziano and her husband, Michael Graziano. We provide digital forensics, OSINT, investigations, cybersecurity and managed IT, with remote support anywhere in the U.S. and worldwide.
Originally published on the Executive Digital Group website on November 12, 2026.