You MUST act fast. The take-away from this Protek Practitioner’s EDGE Tip is this simple:
Failure to move with haste to properly preserve mobile device content puts you at great risk for viable claims of spoliation and/or for missing out on smoking gun electronic evidence.
The Issue: Mobile device content is destroyed very quickly due to both innocuous device usage and nefarious efforts. There are a host of reasons for this, but at the end of the day it all translates into the same result: mobile device content is destroyed very quickly!
Examples:
- Text Messages. Active (non-deleted) messages: as quickly as 30 days.
- Call Logs. Approx 200 entries, days are dependent on user activity level.
- Geolocation Data. From 1 day to 6 months, artifact type dependent.
- User’s Activity (eg, use of apps, contacts, etc.). 30-60 days.
- Message Deletion Activity. 6 months or less.
Important notes:
- Simply turning the device off is not always effective. Some critical items are destroyed on a calendar days basis and will be permanently lost upon turning the device on past the trigger date.
- The exact destruction dates referenced above are in a general state of flux.
What to Do:
- Include an assessment for the possible presence of mobile devices in the in-take process for every new client matter.
- Quickly/Immediately preserve the content of any identified devices in a forensically sound manner and/or issue notice letters to opposing parties demanding the same.
Next Practitioner’s EDGE Installment: What immediate steps should I direct my client(s) to do with their phones prior to preservation/collection?
To receive Protek’s Practitioner’s EDGE Alerts/Tips installments, please send an email to info@protekintl.com with the subject line “Send EDGE.”
Any suggestions for improving the EDGE Alerts/Tips, or anything you’d like to see covered?, drop me a line!
Best wishes!
Keith
0 Comments