New Android Forensics Tool Can Recover Deleted AI Conversations From Phone Memory

Researchers at the Georgia Institute of Technology have developed a digital-forensics tool capable of recovering remnants of deleted conversations with locally running artificial intelligence (AI) assistants on Android devices. The tool, named ORISA, can reconstruct recovered information into a working AI session, potentially giving investigators access to evidence that is no longer visible to the user.

The research was announced on 13 October 2026 and presented at the 2026 IEEE Symposium on Security and Privacy. It addresses a growing challenge for mobile forensic examiners as AI assistants become increasingly common on smartphones.

Local AI assistants process conversations directly on a device rather than relying entirely on remote servers. During operation, conversation data and contextual information may remain in working memory even after a user deletes a chat.

ORISA examines this residual memory for recoverable fragments and uses them to rebuild an AI session.

In one experiment, researchers created a fictional project assistant containing 100 facts. After deleting the conversation, ORISA recovered information and reconstructed a session that returned 26 facts. The original session could access only 14 of those facts, demonstrating that memory remnants may preserve information beyond what the active conversation retains.

The researchers tested the tool across 10 Android applications, three AI models and 60 configurations. Recovery depended on information remaining in memory; subsequent device activity can overwrite these remnants and make recovery more difficult.

ORISA could help investigators examine AI-related activity in cases where conversations may contain evidence of planning, research or other relevant interactions. It also highlights a privacy concern: deleting a conversation does not necessarily eliminate every recoverable trace from a device.

However, the findings concern locally running AI assistants and residual device memory. They do not establish that every deleted AI conversation can be recovered, or that the method works universally across devices and applications.

The research introduces another potential category of mobile forensic evidence, underscoring the importance of careful memory acquisition, validated examination methods and documented limitations when presenting recovered data in legal proceedings.