Depending on the circumstances, they may have taken a backup of the whole device beforehand.