Georgia Tech recovers deleted chats from on-device AI assistants on Android

Georgia Tech's ORISA forensic tool reconstructed deleted conversations with on-device AI assistants on Android from RAM. In a ChatterUI test it recovered 26 of 100 deleted project notes, while the assistant held only 14 before deletion. The study was presented at the IEEE Symposium on Security and Privacy 2026.

• ORISA recovered 26 of 100 deleted project notes in a new session
• Before deletion the assistant retained only 14 notes
• Tests covered 10 Android apps and three LLMs across 60 configurations
• Data lingers in RAM until overwritten by normal phone activity