Recovery of Deleted Data from smartphones, computers and digital storage devices may be possible when important files, photographs, messages or other information have been accidentally or intentionally deleted. At Nikos Pelekasis & Associates, we provide professional data recovery and digital forensic examination services in Athens, Piraeus and throughout Greece.
Deleted information does not always disappear immediately from a digital device. Depending on the operating system, storage technology, encryption, subsequent use of the device and the type of data involved, some information may remain recoverable or identifiable through specialised forensic examination.
However, no professional data recovery service can guarantee that deleted information will always be recovered. Modern smartphones, SSDs, encryption and automatic storage-management processes can make recovery difficult or, in some circumstances, technically impossible.
For this reason, one of the most important actions after discovering that valuable data has been deleted is to minimise further use of the device until it can be evaluated.
Data may be lost for many different reasons.
Some cases involve accidental deletion, while others concern device failure, software problems or information deliberately deleted before an investigation.
Depending on the device and circumstances, our services may involve the examination of:
Before attempting recovery, the device and circumstances should be assessed to determine the most appropriate technical approach.
The information that can potentially be recovered depends heavily on the device, operating system and circumstances of deletion.
Depending on the case, relevant data may include:
The fact that information once existed on a device does not mean that it remains recoverable.
Recovery possibilities must be assessed individually.
Photographs and videos are among the most commonly requested types of deleted data.
Recovery may sometimes be possible from:
Before advanced forensic recovery is attempted, it may also be necessary to determine whether copies still exist in:
If a file has been permanently deleted and the relevant storage space has subsequently been overwritten or securely erased, recovery may no longer be technically possible.
Android devices vary significantly between manufacturers, models and operating-system versions.
Modern Android smartphones commonly use encryption and flash storage, both of which can significantly affect deleted-data recovery.
Depending on the device and circumstances, examination may focus on:
The success of an examination depends on factors including the Android version, security configuration, encryption, device condition and how extensively the phone has been used since the information was deleted.
Modern iPhones and iPads use strong encryption and sophisticated storage-management systems.
As a result, deleted-data recovery from modern iOS devices can be significantly more complex than traditional recovery from older storage media.
Depending on the circumstances, useful information may potentially be identified through examination of:
Permanent deletion, subsequent device activity, encryption and operating-system behaviour can significantly reduce the possibility of recovering the original deleted content.
For this reason, claims that all deleted iPhone data can always be recovered should be treated with caution.
Clients frequently request recovery of deleted messages.
Depending on the device, application and available data, forensic examination may sometimes identify information relating to deleted or existing communications.
Applications may include:
However, modern messaging applications often use encryption, cloud-based storage and database structures that can make deleted-message recovery difficult.
Whether information can be recovered depends on:
Recovery cannot be guaranteed.
WhatsApp conversations may exist in different locations depending on the device configuration.
Relevant information can potentially include local application data, backups or other information still present on a lawfully accessible device.
The technical possibilities differ between Android and iOS.
A deleted conversation does not necessarily remain recoverable indefinitely, particularly if databases have been modified through continued use.
Forensic examination should therefore be considered as early as possible where the information is important.
Similar limitations apply to Viber and other communication applications.
Depending on the application, device and storage configuration, an examination may identify:
The availability of deleted content depends on the technical circumstances and should never be assumed before examination.
Deleted-data recovery from computers depends significantly on the type of storage device.
Traditional hard disk drives and modern solid-state drives behave differently after files are deleted.
Depending on the system, examination may involve:
The operating system and storage configuration should be evaluated before recovery is attempted.
Traditional hard disk drives (HDDs) can sometimes retain deleted information until the relevant sectors are overwritten.
This means that recovery may be possible even after a file has been removed from the recycle bin.
However, continued use of the computer can cause new information to overwrite areas containing deleted data.
For this reason, if important information has been accidentally deleted from an HDD, unnecessary use should be avoided.
Recovery from a modern Solid-State Drive (SSD) can be considerably more difficult.
Many SSD systems use a process known as TRIM, which informs the storage device that particular blocks are no longer required after files have been deleted.
Combined with the SSD’s internal storage-management processes, this can make deleted information unavailable much sooner than on a traditional hard drive.
As a result, methods that may successfully recover deleted files from an HDD may not produce the same results on an SSD.
Each device needs to be evaluated individually.
USB flash drives and memory cards are commonly used for photographs, videos, documents and other files.
Data loss may occur because of:
Depending on the condition of the storage medium, recovery software or specialist forensic techniques may be appropriate.
If the device appears physically damaged, repeated attempts to access it may make the situation worse.
Formatting does not always have the same effect on every device.
Depending on the type of format, file system and subsequent use, some information may remain recoverable.
However, modern secure-erasure procedures, encryption and flash-storage behaviour can make recovery significantly more difficult.
A formatted device should therefore be assessed before additional data is written to it.
A factory reset presents a particularly difficult recovery scenario on modern smartphones.
Older devices sometimes retained recoverable information after a reset.
Modern Android and iOS devices commonly rely on strong encryption. A factory reset can destroy or invalidate encryption keys required to access previously stored information.
Consequently, direct recovery of pre-reset data may be extremely limited or impossible on some modern devices.
However, information may still exist elsewhere, such as in authorised backups or synchronised services.
A technical assessment is therefore necessary before conclusions are reached.
A device does not always need to function normally for information to remain potentially accessible.
Depending on the nature of the damage, examination may be considered for devices affected by:
The appropriate approach depends on the type and severity of the damage.
Where physical repair is required before forensic examination, particular care should be taken to avoid altering or destroying relevant data.
If a device containing important data has suffered water or liquid damage, repeatedly attempting to power it on may cause additional electrical damage.
The appropriate response depends on the device and circumstances.
Where the information has investigative or legal importance, preservation of the data should take priority over ordinary attempts to return the device to everyday use.
Data recovery and Digital Forensics are related but different disciplines.
Standard data recovery primarily focuses on retrieving information that the user wants back.
Digital forensics may have a broader objective: to identify, preserve, analyse and document electronic evidence in a technically appropriate manner.
For example, a digital forensic investigation may examine:
When information may be relevant to a legal or investigative matter, preservation and documentation can be as important as the recovery itself.
Digital forensic examinations should follow structured procedures for the identification, preservation and analysis of electronic evidence, consistent with established digital forensics guidelines.
Deleted information can sometimes become relevant to:
Where the recovered material may eventually be used in a legal context, the examination should be planned accordingly.
The objective should not simply be to copy files from a device, but also to preserve relevant information regarding their source and technical context where possible.
If deleted information may have evidential value, preservation becomes particularly important.
Actions that may modify potentially relevant data include:
In an investigative case, the safest approach is often to stop unnecessary activity and have the device assessed before experimenting with different recovery tools.
When important data disappears, it is natural to try several recovery applications immediately.
However, this can sometimes reduce the chances of a successful professional examination.
Installing software or saving recovered files back onto the same storage device may overwrite information that was previously recoverable.
This is particularly relevant to computers and removable storage media.
Where the information is genuinely important, professional assessment before repeated recovery attempts can be preferable.
Not all apparently deleted information needs to be recovered directly from the device.
Depending on the user’s configuration and lawful access, copies may exist in:
Checking legitimate backup sources can sometimes provide information that is no longer directly available on the original device.
Access must always be authorised.
We do not provide unauthorised access to another person’s cloud accounts.
Recovery of digital information may form part of a broader private investigation.
For example, electronic evidence may be relevant to investigations involving:
Where appropriate, data recovery can be combined with broader Digital Forensics and traditional investigative methods.
Businesses can lose important information through accidental deletion, hardware failure or employee actions.
Depending on lawful authority over the device and data, examination may assist with:
Where misconduct is suspected, preserving the original device and documenting the examination process may be particularly important.
Digital evidence may sometimes be relevant to theft or internal company investigations.
A device may contain documents, images or other information connected with an incident.
Where the organisation or client has lawful authority to provide the device for examination, forensic analysis can potentially assist in identifying relevant electronic evidence.
The technical findings should be considered alongside other investigative evidence rather than in isolation.
When deleted information is relevant to an investigation, Collection of Evidence involves more than simply recovering the file.
Where appropriate, the examination may also document:
The level of documentation required depends on the purpose of the investigation.
Sometimes — but not always.
The term “permanently deleted” can describe several technically different situations.
Recovery depends on factors including:
Therefore, the only responsible answer is that the device must be assessed before the likelihood of recovery can be estimated.
There is no universal timeframe.
A deleted file may remain recoverable for a period of time on one device but become unavailable very quickly on another.
The critical factor is not simply the number of days that have passed.
What matters includes what has happened to the storage system since the deletion occurred.
Continued use can significantly affect recovery possibilities.
In some circumstances, older deleted information can still be recovered, particularly from certain traditional storage devices that have seen limited subsequent use.
In other cases, even recently deleted information may already be unrecoverable.
Modern encrypted smartphones and SSDs are particularly different from older magnetic storage.
The age of the deletion alone therefore cannot determine whether recovery is possible.
We do not advertise a universal recovery percentage because such a figure would be technically misleading.
Success depends on the specific device and circumstances.
A realistic evaluation considers:
In some cases, substantial information can be recovered.
In others, only limited traces remain.
And in certain circumstances, recovery is technically impossible.
Digital devices can contain extremely sensitive personal and professional information.
For this reason, data-recovery and forensic examinations require strict confidentiality.
Information unrelated to the purpose of the examination should not be unnecessarily accessed or processed.
Our work is performed according to the defined investigative purpose and applicable legal requirements.
Possession of a smartphone or computer does not automatically provide unrestricted legal authority to examine all information contained on it.
The circumstances can depend on:
Before accepting a forensic assignment, the lawful basis for examination should be established.
We do not provide unauthorised access to another person’s device, private account or communications.
Where data recovery forms part of a formal investigation, relevant findings can be documented in a technical or investigative report.
Depending on the assignment, the report may contain:
The report should distinguish between information actually identified during examination and conclusions that cannot be technically established.
Nikos Pelekasis & Associates has more than three decades of experience in private and corporate investigations.
Digital evidence increasingly forms an important part of modern investigative work.
Data recovery can be combined with broader forensic examination where the objective extends beyond simply retrieving lost files.
This can be particularly important in legal, corporate and private investigations.
We do not promise that every deleted file can be recovered.
Modern encryption, SSD technology, TRIM and secure deletion can make some information permanently inaccessible.
Each case is evaluated according to the actual technical circumstances.
Devices frequently contain sensitive personal and professional information.
Every examination is therefore handled with particular attention to confidentiality and the defined purpose of the investigation.
Data recovery and digital forensic investigations can be undertaken for clients in Athens, Piraeus, Attica and throughout Greece, depending on the device and requirements of the case.
Sometimes. Recovery depends on the device, storage technology, encryption, subsequent use and the way the information was deleted.
Potentially. The chances depend on the smartphone, operating system, storage configuration, backups and what has happened to the device since deletion.
In some circumstances, relevant information may remain available in application data, backups or other sources. Recovery cannot be guaranteed.
Potentially, but modern iPhones use strong encryption and storage-management technologies that can significantly limit direct recovery of deleted information.
Potentially. Android recovery depends heavily on the device model, Android version, encryption and subsequent use of the phone.
On modern encrypted smartphones, direct recovery after a factory reset may be extremely limited or impossible. However, authorised backups or synchronised copies may still exist.
Sometimes, but TRIM and other SSD processes can make deleted-file recovery significantly more difficult than on traditional hard drives.
Generally, yes. Continued use may modify or overwrite information relevant to recovery. If the data is important, unnecessary use should be minimised until the device can be assessed.
Potentially. Where legal use is anticipated, preservation, documentation and the method of examination become particularly important. The client’s lawyer should advise regarding admissibility in the relevant proceedings.
Yes. Depending on the circumstances, data recovery and digital forensic services can be provided to clients throughout Greece.
If you have accidentally or intentionally lost important information from a smartphone, computer or storage device, contact Nikos Pelekasis & Associates for an initial technical assessment.
Where possible, stop unnecessary use of the device and avoid installing multiple recovery applications before professional examination.
Provide us with information concerning:
Our Recovery of Deleted Data services are available for smartphones, computers and digital storage devices in Athens, Piraeus and throughout Greece.
Our objective is to determine realistically what information may still be recoverable and, where appropriate, preserve and document relevant digital evidence through professional forensic examination.
Nikos Pelekasis & Associates – Recovery of Deleted Data & Digital Forensics in Greece
Athens | Piraeus | Nationwide Digital Investigation Services
Athens Office:
39 Stadiou Street, Athens, 10559
Piraeus Office:
36 Iroon Polytechniou Street, entrance from 8 Dragatsi Street, Piraeus Attica, 185310
