Smart Phones: A New Holy Grail of Digital Evidence for Litigators?   

Using a series of short case studies, 4Discovery’s Jeffrey L. Hartman illustrates how specialized forensics are bringing new evidence to life in modern litigation as the amount of data stored on mobile phones grows.

A vehicle, traveling at highway speeds, gradually veered off the roadway and smashed violently into the rear of a truck parked on the shoulder of the expressway, killing the driver of the car instantly.  Lawyers representing the driver’s family and the truck owner’s insurance company began to examine the facts and theories:  Was the truck parked in a dangerous place?  Were its flashers on?  Was the driver of the car distracted or did he perhaps suffer a medical event?

The focus soon shifted to the shattered mobile phone recovered from the owner’s car.  Could the digital evidence stored on this smartphone tell the story of what happened in the remaining moments of the owner’s life? The phone had been badly damaged.  Digital forensic investigators from law enforcement agencies had determined the issue was unsolvable.

The Evidence
Forensic experts engaged by the truck owner’s insurance company, however, recovered digital evidence from the phone that indicated the driver was visiting his phone’s music application at about the same time as the accident.  Could a distracted, music application-surfing driver be at least partially responsible for his own death? The digital evidence recovered from the smartphone is expected to radically alter the anticipated settlement value of this case.  The amount of electronically stored information (ESI) on mobile devices is huge and growing rapidly, a situation for which attorneys and their clients are generally poorly prepared.

GPS data, text messages, internet activity and photographs recovered from smartphones can be unique, highly relevant and dramatic digital evidence in a wide array of cases. 

Data Storage Shifts to Mobile Phones
A new, rich source of ESI is emerging as mobile devices quickly outpace other computers as the gadgets of choice for most individuals. Tablets, like iPads for example, out-shipped laptops and PCs for the first time last year and the total population of mobile devices (7.3 billion) is now greater than the world’s population (7.0 billion people). Most people, including attorneys, do not understand the vast quantity of data that these devices collect and store, and how this type of ESI is rapidly becoming more significant in modern litigation.  GPS data, text messages (yes, even deleted ones), internet activity and photographs recovered from smartphones can be unique, highly relevant and dramatic digital evidence in a wide array of cases.  ESI residing on a mobile device can change the course of litigation.

Cases in Brief

  • Consider the impact of text messages from the mobile phone of a suicide victim on a medical malpractice case in which a widow is accusing her late husband’s doctors of botching her spouse’s medication plan.
  • Or the production of a suspicious last will and testament, and metadata examination—showing the time and date the will was authored, as well as the will’s ‘‘last accessed’’ data recovered from a dead man’s Samsung tablet. These are actual cases and mobile device digital evidence was central to the engagements.

Some other examples of how computer forensics revealed ‘‘smoking gun’’ evidence:

  • In a recent employment law case, recovering an iPhone back-up became crucial to the prosecution of a high school administrator who was accused of engaging in an improper relationship with a student. The administrator had ‘‘wiped’’ his phone but the back-up that was recovered revealed a history of inappropriate contact with the student that led to a rapid and successful settlement for the school district.
  • A member of a computer forensics team provided key testimony that led to the confession of a man accused of murdering his wife. The digital evidence was GPS data recovered from the murderer’s mobile phone which placed the accused near the location where his wife’s body was ultimately recovered—a pond at the end of a desolate roadway.
  • Perhaps the most compelling piece of digital evidence recovered from a mobile device is from a 2012 case, EEOC v. Yellow Freight. [1]  This matter involved the alleged racial antics of a number of Yellow Freight employees who were reportedly harassing African American employees. The smoking gun was a photograph of a noose placed on a forklift driven by an African American employee that was recovered from a witness who produced the iPhone during discovery. Not surprisingly, the case settled— for a cool $11 million.

Data Lives a Long Time: The Malaysian Airlines Experiment
As computer forensics experts know, data lives a very long time. To illustrate, CNN recently organized an experiment to determine if important digital evidence from passengers’ smartphones could potentially be recovered if the missing Malaysian Airlines Flight 370 is ever salvaged.  Could this data help tell the story of the aircraft’s final moments?  Could recovered un-transmitted texts or perhaps videos provide a coveted final message to the families of the victims?

To test the theory, CNN placed a smartphone in the ‘‘airplane mode’’ (so it could not transmit), shot a series of photos and videos, and then drafted a number of text messages and emails using the phone.

Next, they placed the phone at the bottom of a pressurized cold saltwater tank at Chicago’s Shedd Aquarium for eight days. The result? This data was successfully recovered from the phone.

In the Malaysian Airlines experiment, because the phone was so badly damaged, advanced computer forensics recovery techniques were employed. The phone was completely disassembled, and the saltwater-corroded memory board was cleaned in an alcohol solution.

Next, the phone’s memory chip was removed and the data was directly recovered from the chip itself (known in the computer forensics world as a ‘‘chip-off’’ technique).

Once the data was pulled from the chip, it was subjected to advanced mobile device forensics software, in this case, XRY and Cellebrite forensics software, to translate the raw data into viewable text and video.

This process, performed in a computer forensics lab, took approximately 12 hours to perform, and the recovered data included virtually all of the phone’s text messages, emails, photos and even video recorded by the CNN crew.

More mobile ESI evidence will see its way into courts as judges and litigators gain further knowledge of this aspect of eDiscovery. 

Courts Increasingly Acknowledge Mobile Device Evidence
In EEOC v. Original Honeybaked Ham Co.,[2] attorneys for Honeybaked successfully argued that the mobile devices of some alleged victims of sexual harassment had text messages on their mobile devices that would seem to minimize their assertions of anguish and trauma related to the reported harassment. The judge ordered these individuals to turn over their mobile phones for examination by a neutral expert who would help the judge determine the relevance of the text messages.

These messages ultimately played an important role in the outcome of the case by providing dramatic visual examples of the alleged harassment.

With mobile data steadily increasing, we predict that more mobile ESI evidence will see its way into courts as judges and litigators gain further knowledge of this aspect of eDiscovery.

Spoliation, the Dreaded ‘S’ Word

Lest you are hiding behind the ‘‘it cannot happen to me’’ mindset, consider the outcome in Christou v. Beat- port [3] In Christou, a CEO reportedly lost his mobile device during litigation while he was under a litigation hold. Evidence was presented that text messages would play an important role in the case.

The outcome? The judge, while offering no opinion about whether the phone was intentionally or accidentally ‘‘lost,’’ issued sanctions in the form of an adverse inference against the CEO’s company for failure to preserve relevant and responsive ESI that allowed the plaintiffs to argue whatever inference they hoped the jury would draw.

Duty to Preserve
Preservation issues are bound to frustrate inside counsel and their outside lawyers as they grapple with how to manage, preserve and process the new and potentially explosive source of data found on smartphones.

Are documents on an employee’s iPhone covered under a litigation hold? How do you manage this data as a part of your broader information governance policy? How will you address the challenges of Bring Your Own Device (BYOD) issues in the workplace as employees access company confidential information with their own private phones? (BYOD was identified as the number one eDiscovery risk in a survey conducted by Inside Counsel recently.)

One thing is certain: much of the relevant ESI that will come into play in cases in the future will be located on mobile devices, and this trend will indeed alter the eDiscovery landscape as we know it.

The real question is how attorneys will prepare for this inevitability.

1 EEOC v. Yellow Transportation, Inc. and YRC, Inc., No. 09 CV 7693, N.D. Ill., 6/26/12.
2 EEOC v. Original Honeybaked Ham Co., 2012 BL 294225, 11-cv-02560-MSK-MEH, D. Colo.11/7/12.
3 Christou v. Beatport, LLC., 2013 BL 195402, C.A. No. 10- cv-02912-RBJ-KMT, D. Colo., 1/23/13.

To view a PDF of this article, featured in Bloomberg BNA, click below.
HartmanBloombergBNAArticle