Smartphones and phone collection methods have changed dramatically over the past two decades. From making phone calls and sending text messages to using apps for banking, social media, GPS, and more, our smartphones provide insights into our daily life. As Smartphone capabilities have advanced, so have their storage capacities. Since people now store sensitive information on their phones, users have implemented security settings like encryption. When litigation or an investigation arises, it is important for all parties to work together to ensure mobile device data is accessible, usable, and collected defensibly.
Accessibility
Several factors such as pin codes, passwords, and encryption can impact the accessibility of smartphone data. Recently, solutions have become available to address these challenges. Advances in technology now allow for the possibility of unlocking phones and cracking passwords.
These are not the only factors that impact phone collections. Data may not be accessible if it has been deleted. For example, if there are ephemeral messaging apps present on the device or if the phone’s messaging settings are configured for deletion after a certain time, it can be difficult to recover data. Although data may be deleted locally, it may exist elsewhere like in the cloud or a local backup. In situations where these challenges arise, it is advisable to inquire with a digital forensic consultant about proper data collection.
Usability
Due to advancements in hardware and software technology, sifting through data has become more efficient. These advancements allow analysts to narrow search results, with the potential of reducing the volume of data that needs to be reviewed. Now there are solutions that allow for the defensible targeted collection of mobile devices. With this technology, our examiners can app select at the time of collection. This is particularly valuable for high profile custodians whose relevant data exists primarily in a few select applications. In this instance, we can walk away with the relevant data, leaving personal photos and other data types behind. Previously, data from smartphones could only be reviewed in PDF, Excel, and text file formats. Now, data can be ingested into document review platforms more easily, by converting the data into supported formats such as a Relativity Short Message File (“RSMF”).
Defensibility
Maintaining the integrity of source data is crucial to digital forensics. It is paramount that the source data, including any associated metadata, is not altered in any way. A digital forensics practitioner must work with other team members to ensure that any tasks performed are well documented and can be explained at any time throughout litigation or an investigation. Maintaining proper documentation throughout data’s lifecycle is key to its admissibility in a court of law.
In summary, smartphone technology has evolved, bringing with it many challenges, especially around the accessibility, usability, and defensibility of data stored on these devices. Improvements in technology will continue to bring challenges, but digital forensic practitioners will continue to adopt the latest technologies to overcome challenges during phone collections.
