Smartphone Forensics: 10 Tips From The E-Discovery Trenches

Law360, New York (June 19, 2014, 9:59 AM ET) — A real case study: The principal of a Chicago-area school had been accused of engaging in an inappropriate relationship with a student. The student produced a suggestive text message that she alleged had been sent to her by the principal, who denied sending it. Lawyers for the school district were granted a motion to perform a computer forensics analysis of the principal’s iPhone, which was scheduled in his attorney’s office, with lawyers from both sides in attendance. Armed with the principal’s iCloud log-in credentials (provided by the principal by court order), the computer forensics examiner began his analysis. Because he had secretly “wiped” his iPhone just days before, the principal was confident that the examination would reveal nothing. As predicted, no relevant electronically stored information could be found on the phone. Then, the unexpected happened.

The computer forensics examiner began to download the principal’s iCloud backups of the phone, which revealed in dramatic detail a record of unwanted and inappropriate text messages sent by the principal to the student. Alarmed by this development, and completely unaware that the iPhone backup process had preserved this valuable ESI, lawyers for the principal offered a quick and satisfactory settlement with the student and school district.

Mobile device ESI can be unique, dramatic and highly relevant, and attorneys who ignore it will likely pay a heavy price.

Relevant ESI Now Increasingly Resides on Mobile Phones
A new rich source of digital evidence is emerging as mobile devices quickly outpace other computers as the gadgets of choice for most individuals. Tablets, like iPads for example, out-shipped laptops and PCs for the first time last year, and the total population of mobile devices (7.3 billion) is now greater than the world’s population (7 billion people).[1] What most attorneys do not understand is the vast quantity of data that these devices collect and store, and how that ESI is quickly increasing in significance in modern litigation. GPS data, text messages, (yes, even deleted ones), Internet activity and photographs recovered from smartphones is emerging as a valuable new source of digital evidence in a wide array of cases.

Considering these trends, we have assembled a list of top 10 tips for attorneys dealing with mobile device e-discovery:

1. Counsel Your Clients
Know that e-discovery on mobile devices is real…not a fad. Advise your clients on the issues and risks related to ESI on their employee’s mobile devices, and in particular on the issues related to bring your own device. Remember, BYOD issues were named as the number one e-discovery risk by inside counsel in a recent survey.

2. Don’t Ignore It
Seeking discovery of ESI on mobile devices does not come naturally for most attorneys, since they are simply not accustomed to asking for it, but this data can make or break your case. In the recent U.S. Equal Employment Opportunity Commission v. The Original Honey Baked Ham Company case, for example, attorneys for Honey Baked successfully argued that the mobile devices of some of the alleged victims of sexual harassment had text messages on their mobile devices that would seem to minimize their assertions of anguish and trauma related to the reported harassment. The judge ordered these individuals to turn over their mobile phones for examination by a neutral expert who would help the judge determine relevance of the text messages. These messages played an important role in the outcome of the case.[2]

3. Preserve This ESI During Litigation Holds
Mobile device ESI is often overlooked during litigation holds. This is a mistake. Be mindful of your duty to preserve this relevant data. Consider the outcome in the Christou v. Beatport case. In Christou, a CEO reportedly lost his mobile device during litigation while he was under a litigation hold. Evidence was presented that text messages would play an important role in the case. The outcome? The judge, while offering no opinion about whether she thought the phone was intentionally or accidentally “lost,” issued sanctions in the form of an adverse inference against the company’s CEO for failure to preserve relevant and responsive ESI.[3]

4. Remember ESI on Smartphones Is Hard to Destroy
Have you received mobile devices during discovery that appeared to be destroyed or inoperable? Check them out anyway, as the digital evidence on those phones can survive an astonishing amount of damage. In a recent experiment conducted by my firm and televised on CNN, for example, we recovered text messages, videos and emails from a smartphone that was submerged in the bottom of a saltwater tank for over a week.

5. The Power of a Protocol
Understandably, custodians of ESI can become exceedingly troubled when they are asked to turn over their personal smart phones as a part of litigation. Having a thoughtful computer forensics protocol in place that defines the process and prohibits production of personal/non-related (or privileged) information will be very important when you are requesting mobile devices during discovery. The protocol should address the security of confidential information on the devices, the rapid return of the original devices to the owners, and how the costs of computer forensics will be allocated to the various parties. Your protocol may even allow for a special master or other “neutral” computer forensics expert that can manage the collection and processing of ESI on these devices independently, as a means for mitigating objections from your opponent.

6. The Social Media Connection
Keep in mind that smartphones are becoming the tool of choice for posting information to social media sites. For that reason, your discovery process for mobile devices should also consider how the mobile device may have been used as a conduit for posting relevant ESI to a user’s social media site such as Twitter, Facebook, etc., as this information can be critical to your case as well, and should be preserved in advance of litigation.

7. Understand BYOD
While you should begin the process of being a trusted adviser to your clients on those issues and risks related to BYOD, (for example, how your client’s employees might be misappropriating intellectual property with their personal smart phones), you should also remember how your opponent’s employees’ phones could be logical targets of discovery during litigation, and how your opponent’s BYOD policies, or lack of same, could come into play during discovery. Does your opponent have in place, for example, a BYOD policy requiring employees to produce their mobile devices for examination when litigation is reasonably likely? This knowledge can factor into your electronic discovery policy.

8. The Relevance to a Wide Array of Cases
A deleted text message in an insider trading case becomes “Exhibit A” at trial, a recovered photo depicting a noose hanging on an African American’s forklift in a racial harassment case leads to an $11 million settlement (See EEOC v. Yellow Freight), and the Web-surfing history of a suicide victim is central to a settlement in a medical malpractice case. These are actual cases we have worked on in which digital evidence from a mobile device was critical. As mobile device e-discovery becomes more mainstream in litigation, you should expand your mind with respect to how this emerging repository of ESI can become a new source for the best evidence in your case.

9. Integrate This ESI Into Your Case Management Platforms
The outputs of ESI from popular mobile device computer forensics software tools migrate nicely into most popular litigation-support document review applications like Summation, Concordance and Relativity. Forensic software tools like Cellbrite, Access Data’s MPE+, and XRY now have good data migration components that will enable the conversion of mobile device ESI into your review tool of choice. To fully maximize the efficiencies and effectiveness of ESI from mobile devices, it should be processed in a format that is easily converted into the review programs that your firm utilizes.

10. Get Educated
Litigators who succeed in our evolving e-discovery world will be the ones that adapt and learn how to navigate these complex issues and use technology to their advantage. Take the time to understand these issues, or at least recruit a tech-savvy associate at your firm to be your e-discovery internal expert.

One thing is for sure; much of the relevant ESI that will come into play in cases in the future will be located on mobile devices, and this trend will indeed alter the e-discovery landscape as we know it. The real question is how attorneys will prepare for this.

The opinions expressed are those of the author(s) and do not necessarily reflect the views of the firm, its clients, or Portfolio Media Inc., or any of its or their respective affiliates. This article is for general information purposes and is not intended to be and should not be taken as legal advice.

[1] Research company IDC predicts that in 2013, for the first time, more tablets will be shipped than laptops.[2] EEOC v. Original Honeybaked Ham Co. of Georgia, 11-CV-02560 (C. Colo. Nov. 7, 2012) [2012 WL 5430974; 2012 U.S. Dist. LEXIS 160285] [3] Regas Christou vs Beatport, LLC and Bradley Roulier. No. 10-cv-02912-RBJ-KMT. United States District Court for the District of Colorado. Judge R. Brooke Jackson. An adverse jury inference was allowed.