So, while working on my dissertation I discovered something I thought was of interest. It turns out I performed a good portion of my project thinking such things as deleted messages can’t be recovered because of the iPhone’s encryption chip leaving any raw data unreadable. I was not aware that sqlite databases do not actually remove the data from themselves, but instead must in some manner just delete the reference to the record somewhere.
Somebody has created a tool to recover this data, but is only available to beta testers. It can be found here. I’m quite fancying doing some research about this over summer and seeing if I can create my own tool. Wish me luck!
If anyone wants to get involved or at least throw me some info on this please comment or email