Getting the Message: Considerations for Discovery of Mobile Device Evidence

In our last post, we discussed considerations for use of mobile devices in the workplace. Those considerations impact the eventual discovery of mobile device evidence, but there are additional considerations when actual discovery of those devices may need to be performed.

Data Available Within Mobile Devices

While text messages are the most common source of data that can be discoverable from mobile devices, there are several other data types unique to mobile devices that should be considered as well, including:

• Phone Logs: These are key for piecing together communications and can lead to identification of other custodians or third parties with potentially relevant information.
• Voicemail: As is the case with landline phones, recorded voicemail messages are often responsive to discovery requests.
• Photos: Many cases today involve photos of damages or place individuals at the scene of an incident. Photos contain important metadata that includes not just the date and time, but also the geolocation at which the photo was taken.
• Videos: Many cases today also hinge on videos of the incident. The ubiquity of mobile devices and the ease of taking videos makes them much more common as evidence in cases today. Cameras on mobile devices are everywhere!
• Files: Relevant files that aren’t available elsewhere within the data collection may have been downloaded directly to the mobile device.
• Notes and Voice Memos: Many people use a notes or voice memo app for taking notes (written or audio) on their mobile devices which aren’t available elsewhere.

Those are just some of the examples of standard types of data from mobile devices that are routinely responsive in discovery. Other types of data that may be responsive includes: browser history, contacts list, geolocation data and installed apps (which could lead to discovery of additional sources of ESI).

In 2018, Craig Ball published a blog post and guide to mobile device discovery titled Mobile to the Mainstream, which provide excellent guidance on mobile device discovery. The centerpiece of both is his Mobile Evidence Burden and Relevance Scorecard, which provides a list of mobile data types and rates the ease of collection and ease of review (easy, moderate, difficult), potential relevance (frequent, rare, case specific) and whether you should routinely collect it (yes, no, maybe). This is a terrific guide to consult when there is a potential of mobile device discovery in your case.

Challenges to Mobile Device Discovery

There are several challenges that complicate discovery of data from mobile devices, including:

Preservation and Collection

The challenge of preserving and collecting data from mobile devices is one of the biggest impediments to mobile device discovery and it is one of the biggest reasons why attorneys often agree not to pursue data from mobile devices in discovery. Preservation and suspension of auto-deletion of messages is a challenge, especially for BYOD devices, as those devices aren’t within organizational control, so organizations are often dependent on the custodians themselves to suspend auto-deletion. Explicit follow-up with these custodians can be important to ensuring preservation of potentially responsive evidence.

Collecting mobile device data can often be challenging as well. Evidence is often manually extracted by capturing screenshots of text messages and other  communications, but that simplemethod doesn’t capture the metadata as well. Capturing the metadata often requires the use of a forensic examiner and forensic collection software to perform a logical, file system, or physical (bit-by-bit) copy of the data from the device, though remote collection methods have become popular since the pandemic, enabling the custodian to provide remote access to the examiner and avoid having to surrender the device.

An experienced professional can provide guidance and assistance on which collection method is appropriate for your case.

Defining and Displaying Conversations in Text Messages

Another challenge is defining and presenting conversations in text messages to make good sense and accurately represent the exchange. Unlike emails where every email is a snapshot of the conversation up to that point, text messages are individually stored, requiring the conversations to be pieced together in a logical manner – often by day or through the entire exchange between the parties.

The way text message conversations are displayed within your review platform is key to being able to review text messages in context, as search terms may hit on only selected messages within a conversation. To provide full context, the platform still needs to enable review of the entire conversation, including messages not retrieved by search terms.

Emoji

The use of emojis in communications can also be challenging, as they are not generally searchable within eDiscovery platforms and their meaning within the message may be subject to interpretation. While there is Unicode list of over 3,600 accepted emojis (v15.0, available here), there are millions of custom emojis being used in platforms like Slack, which reportedly has at least 26 million custom emojis that have been created.

Emojis may also look different between different operating systems, which can change the interpretation of their meaning. For example, the playful looking water pistol emoji (in line 1094 of the Unicode list linked above) looks much more like a real gun when displayed within Gmail, SoftBank, and KDDI.

Privacy Considerations

In this era of stronger data privacy laws, custodians may object to discovery of their personal mobile devices (including BYOD devices) on privacy grounds. While courts have consistently found that responsiveness to litigation supersedes privacy concerns, that responsiveness may have to be demonstrated to the court if the party objects to discovery from their mobile device. For custodians within your organization, your BYOD policy can address privacy rights vs. organizational rights explicitly.

Conclusion

Data from mobile devices is routinely responsive in discovery today, but there are several challenges relating to collection, review, and production. It’s important to work with an experienced eDiscovery professional who can assist in determining when mobile device discovery is necessary and how to accomplish it efficiently and effectively.

Next time, we will look at recent notable case law rulings involving discovery or mobile device data.

For more regarding Cimplifi forensics & collections services, click here.

Don’t miss out on all the blogs in this series! You can still catch up by checking out the links below.

Getting the Message: Modern and Multi-Channel Conversations

Getting the Message: Considerations for Use of Mobile Devices in the Workplace

Getting the Message: Considerations for Discovery of Mobile Device Evidence

Getting the Message: Ten Recent Case Law Rulings Involving Mobile Device Discovery

Getting the Message: Considerations for Using Chat/Collaboration Apps in the Workplace

Getting the Message: Considerations for Discovery of Evidence from Chat/Collaboration Apps

Getting the Message: Ten Recent Case Law Rulings Involving Chat/Collaboration Apps

Getting the Message: Modern and Multi-Channel Conversations