Deleting a conversation with artificial intelligence (AI) on a smartphone does not always mean the data disappears completely. Specialists at the Georgia Institute of Technology (Georgia Tech) have developed a tool called ORISA that can find traces of deleted dialogues in the memory of Android devices and recover them as a new working AI session.
This concerns local AI assistants - programs that run directly on the phone without sending conversations to a cloud service. While such an assistant is running, parts of a conversation may remain in the device's RAM even after deletion. ORISA searches this memory for fragments of erased dialogues.
In one experiment, the researchers created a fictional assistant, "Project Note Keeper," based on the Android app ChatterUI. It was given 100 fictional facts about a certain project, and then the conversation was deleted. ORISA recovered part of the information and assembled a new working session from it. When the recovered assistant was asked to list the notes about the project, it returned 26 facts. At that moment, the original session could access only 14 facts - the rest had already left its active memory.
Thus, the experiment showed that it is possible to extract information that the AI had already stopped actively using. "This helps establish what information a person shared with an AI assistant and what help they received," explained Ken Xu, a graduate student and the first author of the work.
The researchers tested ORISA on 10 Android apps and three AI models. In 60 test configurations, the tool found information from conversations in the phone's memory. However, the more actively memory is overwritten by other processes, the harder it is to recover data, the authors note.
The work was presented at the IEEE Symposium on Security and Privacy 2026. The paper is titled "Recovering and Rehosting Mobile Local LLM Conversations and Contexts via Memory Forensics." Its authors are graduate students Xu, David Oygenblik, Runze Zhang and Mingxuan Yao, research fellow Muhammad Ibrahim and associate professor Brendan Saltaformaggio. The study was carried out at Georgia Tech's Cyber Forensics Innovation Laboratory - a joint project of the School of Cybersecurity and Privacy and the School of Electrical and Computer Engineering.
According to the authors, on the one hand, the method gives digital investigators a new way to extract information from phones. On the other, it raises privacy questions for those who use local AI assistants.