Georgia Tech Tool Recovers Deleted AI Conversations From Android Memory

Georgia Institute of Technology researchers have developed a forensic tool that can recover deleted conversations from artificial intelligence assistants running locally on Android phones, raising new questions about privacy and digital evidence. The tool, called ORISA, can locate traces of prior chats in a phone’s working memory and reconstruct them into a functional AI session, suggesting that deleting a local AI conversation may not fully erase the information the assistant processed while the app was active. The research focused on local AI assistants that run directly on a device rather than transmitting conversations to cloud services. Even after users delete a chat, fragments of the conversation may remain in the phone’s memory, and ORISA is designed to search for those residual fragments. In one experiment, the team created a fictional assistant named Project Note Keeper using the ChatterUI Android app, fed it 100 project facts, and then deleted the conversation. ORISA recovered data from the deleted session and rehosted it into a new assistant, which returned 26 facts when asked to list the notes it had received. By comparison, the original session could access only 14 facts because the rest had fallen outside its active memory. The experiment demonstrated that deleted AI interactions can contain recoverable context, including information the assistant had already stopped using actively. Across 10 Android applications and three AI models, ORISA recovered conversation data in 60 test configurations, although the researchers noted that recovery becomes more difficult as the phone’s memory is overwritten by other activities. The work could assist digital investigators in understanding what information users shared with AI assistants and what responses they received. It also highlights privacy risks for people who rely on on-device AI tools, since locally stored assistants may retain more trace data than users expect. The findings were presented at the 2026 IEEE Symposium on Security and Privacy. The paper, titled “Recovering and Rehosting Mobile Local LLM Conversations and Contexts via Memory Forensics,” was authored by Ph.D. students Ken Xu, David Oygenblik, Runze Zhang and Mingxuan Yao, research scientist Muhammad Ibrahim, and associate professor Brendan Saltaformaggio. The work was conducted in Georgia Tech’s Cyber Forensics Innovation Laboratory, a collaboration between the School of Cybersecurity and Privacy and the School of Electrical and Computer Engineering.