EDGE Tip: Preserve phones quickly!

You MUST act fast. The take-away from this Protek Practitioner’s EDGE Tip is this simple:

Failure to move with haste to properly preserve mobile device content puts you at great risk for viable claims of spoliation and/or for missing out on smoking gun electronic evidence.

The Issue: Mobile device content is destroyed very quickly due to both innocuous device usage and nefarious efforts. There are a host of reasons for this, but at the end of the day it all translates into the same result: mobile device content is destroyed very quickly!

Examples:

• Text Messages. Active (non-deleted) messages: as quickly as 30 days.
• Call Logs. Approx 200 entries, days are dependent on user activity level.
• Geolocation Data. From 1 day to 6 months, artifact type dependent.
• User’s Activity (eg, use of apps, contacts, etc.). 30-60 days.
• Message Deletion Activity. 6 months or less.

Important notes:

1. Simply turning the device off is not always effective. Some critical items are destroyed on a calendar days basis and will be permanently lost upon turning the device on past the trigger date.
2. The exact destruction dates referenced above are in a general state of flux.

What to Do:

1. Include an assessment for the possible presence of mobile devices in the in-take process for every new client matter.
2. Quickly/Immediately preserve the content of any identified devices in a forensically sound manner and/or issue notice letters to opposing parties demanding the same.

Next Practitioner’s EDGE Installment: What immediate steps should I direct my client(s) to do with their phones prior to preservation/collection?

To receive Protek’s Practitioner’s EDGE Alerts/Tips installments, please send an email to info@protekintl.com with the subject line “Send EDGE.”

Any suggestions for improving the EDGE Alerts/Tips, or anything you’d like to see covered?, drop me a line!

Best wishes!

Keith