guides

Published by Floriva · Updated 2026-05-01 · How Floriva checks its guides

Digital Forensics and Period Tracker Apps: What Investigators Can Find

Digital forensic tools can recover deleted period tracker data from phones and cloud backups. Here is what investigators can actually find, what deletion does, and what on-device storage means for forensic analysis.

Mobile forensic tools used by law enforcement can extract period tracker data from phones, including data the user deleted within the app. Cloud-synced apps create additional copies on company servers and in device backups that survive app deletion. On-device-only apps limit forensic recovery to the physical device itself, and proper device encryption significantly raises the difficulty of extraction.

What Forensic Tools Actually Do

When law enforcement seizes a mobile device as evidence, they do not open apps and scroll through them manually. They use specialized forensic extraction tools, commercial products sold by companies like Cellebrite, Grayshift (Magnet GrayKey), MSAB (XRY), and Oxygen Forensics. These tools connect to the device and extract data at levels below what the user interface shows.

The extraction process works at multiple levels:

File system extraction: Copies the device's file system, including app databases, configuration files, and cache directories. Period tracker apps store data in SQLite databases or similar structured files. A file system extraction retrieves these databases wholesale, including entries the user deleted within the app if the database has not been compacted.

Logical extraction: Captures data accessible through the operating system's backup mechanisms. This is equivalent to what an iTunes or Google backup would contain. App data included in backups appears in the extraction.

Physical extraction: Creates a bit-for-bit image of the device's storage chip. This captures everything, including data in unallocated space, areas where deleted files previously existed but have not yet been overwritten by new data. This is the most invasive level and the most likely to recover "deleted" data.

Cloud extraction: Using the user's credentials or legal process directed at cloud providers, investigators can obtain iCloud backups, Google Drive backups, and data synced to cloud services. This does not require physical access to the device.

What Period Tracker Data Looks Like to a Forensic Examiner

A forensic examiner extracting period tracker data typically finds a SQLite database containing structured tables with:

• Cycle records (start dates, end dates, flow intensity) with timestamps

• Symptom entries linked to specific dates

• Fertility predictions and ovulation estimates

• User-entered notes and journal entries

• App configuration (notification settings, tracking preferences)

• Account identifiers and authentication tokens

Each entry has metadata: when it was created, when it was last modified, and often a deletion flag. Many databases use "soft delete", marking records as deleted rather than removing them. These soft-deleted records are fully readable by forensic tools.

The Cloud Problem

Cloud-synced period trackers create multiple copies of your data across different systems:

App company servers: Flo, Clue, Natural Cycles, and other cloud-based trackers store your data on their servers. This copy persists until you submit a deletion request and the company processes it. Some companies retain data for defined periods after deletion requests.

Device backups: If your phone backs up to iCloud or Google Drive, and the period tracker's data is included in backups, every backup snapshot contains a copy of your period data at that point in time. Old backups may contain data you later deleted from the app.

Sync services: Some apps sync through Apple Health, Google Fit, or Samsung Health. Data shared with these platforms is stored separately and is not deleted when you delete the source app.

Each of these copies is a separate forensic target. Deleting the app and clearing its data from your device does not affect server copies, backup copies, or health platform copies. An investigator can potentially obtain period data from any of these sources through different legal mechanisms.

What "Deletion" Actually Does

When you delete a period entry within an app, the app typically:

1. Marks the record as deleted in its database (soft delete)

2. Removes it from the app's visible interface

3. Syncs the deletion to the server (if cloud-based), which may or may not actually remove the record

When you delete the app:

1. The operating system removes the app and its primary data directory

2. The storage space is marked as available for reuse

3. The actual data bytes remain on the storage medium until overwritten

4. Cloud backups, server copies, and health platform copies are unaffected

When you submit a data deletion request to the company:

1. The company processes the request (timeline varies)

2. The company's retention policy determines what is actually deleted vs. archived

3. Data already shared with third-party SDKs or data brokers is outside the company's control

4. Backup systems may retain copies for defined periods

Device Encryption: The Meaningful Barrier

Modern smartphones use full-disk encryption that is the single most important factor in forensic resistance.

iPhones: All iPhones since the iPhone 6 use hardware-based encryption tied to the device passcode. Data at rest is encrypted. Without the passcode (or an exploitable vulnerability), forensic tools cannot decrypt the storage. Apple does not hold the decryption key.

Android: Android devices running version 10+ with hardware security modules provide comparable encryption. The effectiveness depends on the manufacturer's implementation. Flagship devices from major manufacturers generally have strong encryption.

Passcode strength matters: Forensic tools that attempt to bypass encryption often use brute-force passcode attacks. A 4-digit PIN has 10,000 possible combinations. A 6-digit PIN has 1 million. An alphanumeric passcode with letters, numbers, and symbols can have billions. Longer, more complex passcodes make brute-force extraction impractical.

On-Device Architecture and Forensic Exposure

An app that stores data only on the device creates a fundamentally different forensic profile:

No server to subpoena: There is no company database containing your records. A subpoena to the app developer yields nothing because nothing was transmitted.

No cloud sync to intercept: No data was sent to servers, so there is no readable central copy, no cloud sync log, and no transmission metadata.

No backup inclusion (if designed properly): On-device-only apps can be configured to exclude their data from device backups, eliminating the backup copy vector.

Device extraction is the main path: For an on-device-only app with backups excluded, the data exists on the device itself, so obtaining it requires physical possession and the ability to bypass device encryption.

This does not make the data invisible to forensics. If an investigator has the device and can unlock it, they can access the app's data. But it reduces the attack surface from multiple copies across multiple systems to a single copy on a single device, protected by that device's encryption.

What You Can Do

1. Use a strong passcode: Six digits minimum, alphanumeric preferred. Enable biometric unlock for convenience, but know that biometric bypass has different legal treatment than passcode compulsion in some jurisdictions (this is not legal advice, consult an attorney).

2. Keep your device updated: OS updates patch the vulnerabilities that forensic tools exploit. An iPhone running the latest iOS is harder to extract than one running a two-year-old version.

3. Understand what your period tracker syncs: Check whether your app stores data on servers, syncs to Apple Health or Google Fit, and whether its data is included in device backups. Each sync point creates an additional forensic target.

4. Consider architecture: An on-device-only app with no cloud sync and no backup inclusion creates the smallest possible forensic footprint. Combined with a strong passcode and current OS, this is the most forensically resistant configuration available to a consumer.