Phone data recovery
Deleted photos, WhatsApp, Signal, SMS and contacts from iPhone and Android. We search the phone, backups on your computer, and iCloud and Google accounts. Also phones that won't turn on after a drop or water.
// Service · Digital forensics
We find out what really happened in the data.
We recover deleted messages and photos from phones, examine computers, e-mail or Microsoft 365, and write it up so it holds up in front of a lawyer or a board. Before we start, we tell you what is realistic.
Free consultation · Price estimate before recovery · Written report even when nothing is found
// About the service
The question first, then the data.
Forensic work doesn't start with a tool but with a question: what exactly do you need to find out, and what for. We secure the data accordingly, make copies with checksums and work only on the copy, the original stays untouched. We work for companies, law firms, IT providers and individuals; with individuals we always verify they have a right to the data.
// What we handle
Six situations people bring to us.
Communication as evidence
For a dispute, an employment matter or negotiations we secure messages and e-mails with checksums, a method description and a timeline. We check whether a screenshot matches the data on the phone.
Computers and laptops
What was deleted, opened, copied to USB or sent. Typically when an employee leaves for a competitor and the company needs to know what they took.
E-mail and Microsoft 365
Who signed in to the mailbox and from where, what they shared or downloaded, which forwarding rules someone set up. Header analysis of suspicious e-mails. The same in Google Workspace.
Incident investigation
A compromised account, a forged invoice, a data leak. We find how the attacker got in, what they did and what they could take, and propose how to close the hole.
Authenticity of files and photos
Metadata, edit history and consistency of documents, photos and chat exports. When you need to know whether something was altered afterwards.
// Straight talk
What can be found and what can't.
We don't quote success rates. With modern phones, encryption and what happened to the phone after deletion decide the outcome, not the lab.
- Realistic: a dead phoneIf the main board can be brought back to life and you know the passcode, the data is usually intact. The encryption key lives in the processor, so the original phone gets repaired.
- Realistic: backups and accountsiCloud, Google, computer or Mac backups, local WhatsApp backups. This is where deleted data turns up most often.
- Realistic: recently deletedItems in the trash and records the app hasn't overwritten yet. The sooner you call, the better.
- Not realistic: factory reset without a backupA reset destroys the encryption keys and the data on the phone becomes unreadable to anyone.
- Not realistic: forgotten passcodeWe don't crack locked phones. We need the passcode from the owner.
- Not realistic: old deleted photos from an iPhoneEvery file on an iPhone has its own key. Once deleted from storage, only backups remain.
If a case is clearly hopeless, we tell you on the phone for free. You don't pay for diagnostics that have no chance.
// What it costs
You get a price estimate before recovery.
After diagnostics you know what is realistic and what recovery will cost. Only then do you decide. We can't guarantee the recovery result; you pay for expert work and the report, even if nothing is found.
What the device and backups hold
We examine the device and backups and you get a written result: what is available, what isn't and why.
Recovery price in writing
Based on the diagnostics you get an estimate for recovering the phone data. Nothing is added along the way.
Forensic analysis and incidents
Computers, e-mail, Microsoft 365, company incidents and material for disputes. We propose scope and price after the first consultation.
Describe what happened. We'll get back to you within one business day and tell you whether it makes sense to continue.
Describe the situation → or call +420 211 221 865
// How we work
A documented process from intake to handover.
We record every step, so it is always clear who did what with the data.
01
Free consultation
On the phone we go through what happened and what you need to find out. We verify you have a right to the device and data, and tell you whether it makes sense to continue.
02
Intake and acquisition
We take the device over with a handover record, make copies and record their checksums (SHA-256). From then on we work only on the copy.
03
Analysis
We recover and analyse the data according to the brief. Key findings are verified a second, independent way, and we note where we are not certain.
04
Report and handover
You get a report with the method, findings, timeline and the limits of the analysis. Data is handed over encrypted and copies are deleted after the agreed period.
// What we use
Proven tools and documented methods.
// Phones
- iLEAPP, ALEAPP
- MVT (spyware traces)
- iTunes and Finder backups
- Google Takeout, iCloud
// Computers
- Autopsy, Sleuth Kit
- FTK Imager
- Velociraptor
- disk images with SHA-256
// E-mail and cloud
- Microsoft 365 audit log
- Google Workspace
- e-mail header analysis
- forwarding rules
// Method
- NIST SP 800-86
- NIST SP 800-101
- chain of custody
- handover records
// Data protection
- encrypted storage
- NDA on request
- data processing agreement (GDPR)
- documented deletion of copies
// Deliverables
- technical report
- timeline
- chat export
- material for a court expert
// FAQ
What you want to know before trusting us with your data.
Why isn't diagnostics free?
It is several hours of real work and you get a written result: what is in the device and backups, what isn't and why. Labs with free diagnostics usually don't issue a written record.
If a case is clearly hopeless, we tell you on the phone for free.
Do you guarantee you'll recover the data?
No. Modern phones are encrypted and the result depends on what happened after deletion. Anyone promising a 95% success rate is counting mostly hard drives, not phones.
We guarantee an honest process and a report, even if it is negative.
Can WhatsApp or photos be recovered after a factory reset?
Not from the phone, the reset destroys the encryption keys. Backups remain: iCloud, Google, your computer, local WhatsApp backups. We check those.
Will the report be usable in court?
We issue a technical report with a documented method, checksums and chain of custody. It is not a court expert opinion, and the court decides how evidence is used.
If you need an expert opinion, the secured data and our report serve as material for a court-appointed expert.
May a company examine an employee's work laptop or phone?
The device belongs to the company, but Czech labour law protects the employee's private communication. We therefore agree the scope upfront, ideally with your lawyer.
Can you crack a locked phone?
No. We need the passcode from the owner. We don't open locked devices without the owner's consent.
Who will see my data?
Only us. Confidentiality is a given, we sign an NDA and with companies we conclude a data processing agreement. After handover we delete the copies and confirm the deletion.
How long does it take?
Diagnostics usually takes a few business days. We tell you the analysis deadline upfront based on scope. If you're in a hurry, say so on the first call.
Need to find out what happened in the data?
Call us. In a few minutes we'll tell you whether it makes sense to continue and what it will cost.
Call +420 211 221 865 →
// Contact
Get in touch.
Tell us what you need, or just call. We reply within one business day.
- E-mailinfo@hruby.software→
- Phone+420 211 221 865→
- StudioPod Slovany 1888/12, Prague 2→
- HoursMon–Fri · 09:00–18:00 CET→