When a user deletes an application from his device, is the data truly gone? Is this data recoverable? It honestly depends on the device and the version of Android running. Best practices encourage the examiner to examine the databases provided by the tool. This means to go to the Databases section in Physical Analyzer and Oxygen or examine the file system and find application directories of interest. The image file should also be loaded into AXIOM or IEF where a full search can be run across the entire image to ensure that the data is not present on the device. Should you not have a commercial tool, do the same in Autopsy.

The SD card and/or USERDATA/media directory should be examined for traces of files associated with the application. Deleting an application does not mean the data stored in the SD card is removed. The CACHE partition may contain a vast amount of data as well. As a last-ditch effort, Google could be contacted to provide the user data stored in the cloud. Of course, this requires proper legal authority or consent.