There are many legitimate and illegitimate reasons why someone might wipe a computer’s hard drive or keep an old phone locked. However, in the context of an investigation or legal dispute, these actions can raise questions and may prompt further examination.

Some possible reasons include:

Innocent reasons

• Protecting personal privacy before selling or disposing of a device.
• Removing sensitive financial or business information.
• Preventing identity theft.
• Resetting a device because it is no longer working properly.
• Forgetting the passcode to an old phone.
• Keeping private photos, emails, or personal correspondence secure.

Reasons that may raise concern

An investigator might consider whether the person was trying to:

• Hide communications such as emails, text messages, or chat logs.
• Destroy evidence of financial transactions.
• Remove photographs, videos, or documents.
• Conceal evidence of an affair or other secret relationships.
• Erase internet browsing history or downloaded files.
• Hide evidence of fraud, coercive control, harassment, or other unlawful conduct.
• Prevent investigators, former partners, or law enforcement from accessing information.

In cases involving domestic abuse

In investigations into coercive control or domestic abuse, digital evidence can be crucial. Phones and computers may contain:

• Threatening or abusive messages.
• Evidence of stalking or monitoring.
• GPS or location tracking.
• Financial records showing economic abuse.
• Photographs or recordings.
• Social media communications.
• Searches that reveal planning or intent.

If someone wipes a hard drive or destroys a device after they know there may be an investigation or legal proceedings, investigators may ask why this happened and whether relevant evidence has been lost. Depending on the jurisdiction and circumstances, intentionally destroying evidence during an investigation can have legal consequences.

Can deleted data still be recovered?

Often, yes. Digital forensic specialists can sometimes recover:

• Deleted files.
• Deleted photographs.
• Text messages.
• Emails.
• Browser history.
• Metadata showing when files were created, modified, or deleted.
• Information from cloud backups.
• Fragments of deleted data that remain on storage media.

Even if a hard drive has been wiped, recovery may still be possible depending on how it was wiped, whether it has been overwritten, and the type of storage device involved. Similarly, a locked phone may still yield evidence if investigators obtain lawful authority and have the technical means to access it.