Mobile device discovery and investigations

Mobile devices

Ninety percent of all Americans have a mobile device; fifty percent of Americans have a smart phone:

• Mobile devices contain, in some cases, more data types than in traditional computers.
• Mobile devices are not just phones; they are mobile computers, text devices, cameras, and more.

Mobile devices intentionally or unintentionally contain a record of peoples’ lives. Just as computer data has been critical in litigation matters in the past, data from mobile device applications, photographs, and text messages can be more valuable than ever before. A complete capture of mobile device data and any backups, such as those from iTunes or from Blackberry devices, provide an essential part of the electronic data collection for every custodian.

Back to top

Mobile forensics

Mobile device forensics has continued to evolve with the change from cell phone to smart phone. Today, we efficiently deal with over twenty-one data types such as text messages, voicemail, and call logs. Some of these data types will actually contain geographic locations. We are able to process Gigabytes of data which could yield relevant information. Further, we have the ability to exploit new technologies to automate the conversion of thousands of lines of data extracted from a mobile device into individual files or a load file, which can be ingested for hosting, review, and then ultimately produced by counsel.

Back to top

Challenges

Both mobile device forensics and traditional forensics typically deal with four principal operating systems and a near exponential increase in data size. However, unlike traditional PC forensics, mobile device forensics must address a plethora of changing configurations that lack industry standards, as well as a very short development cycle for updated operating systems. Maintaining quality and efficiency with such short life cycles is the challenge that sets mobile device forensics apart.

Back to top  

Mobile device policies

Corporate mobile device policies, including the use of Mobile Device Management (MDM) software and the move to Bring Your Own Device (BYOD) have impacted discovery in subtle, yet profound ways. The decision to deploy MDM provides essential security, an inherent, in-depth inventory system, and a potential collection platform. BYOD, while it typically saves money and increases job satisfaction, it also typically complicates security and discovery by introducing a heterogeneous mobile environment, fostering increased personal use and complicating collection, review and redaction of mobile data.

Back to top

Actionable items

Essential to any discovery matter or investigation is the involvement of all parties in advance planning including management, legal, and technical personnel.

First, establish an inventory of devices. It can be as simple as keeping a spreadsheet or downloading a list from your MDM of devices and custodians.

Second, ensure you have written policies and procedures in place that cover the data types found on mobile devices, but that are generic enough to anticipate new applications as they arise.

Lastly, the move to BYOD brings both of these steps into sharp focus. In a BYOD environment both an inventory of devices and up to date written policies and procedures are essential.

Back to top

Matt's take

Mobile device discovery will become commonplace to traditional electronic discovery and investigations. Mobile device discovery will continue to change with the evolution and proliferation of these devices. The increased penetration of mobile devices into our lifestyle will propel them into the discovery and investigation practices. The value of the data that can only be found on the mobile devices will continue to rise. These factors will inevitably move mobile device data into commonplace electronic discovery and investigations.

Back to top