1-877-764-0920 
Two recent rulings in the same case illustrate the importance of mobile device forensic discovery in litigation.
In the case Measured Wealth Private Client Group v. Foster, et al. (covered here by Forensic Discovery Educational Partner eDiscovery Today), Florida Magistrate Judge William Matthewman ordered a mobile phone forensic examination for two different individual defendants over a two month period. The case involved misappropriation of trade secrets claims against the defendants, who left the plaintiff’s employment and joined a direct competitor of the plaintiff.
“From a collection standpoint, it is an all or nothing scenario when it comes to preserving/collecting text message communications on mobile devices.”
In the second ruling, Judge Matthewman stated that “text messages and iMessages responsive to Plaintiff’s discovery requests from the period of January 1, 2019 through December 31, 2019, are relevant and proportional to the claims and defenses in this case.” He also stated that “Defendant appears to have been obstructionist with regard to her production of text messages and iMessages during the discovery process.”
Let’s take each of these points, one by one:
As business communications through text message have become more common, it has become more likely that those messages will be relevant to discovery. In this case, text messages between the individual defendants as well as with employees of the direct competitor would logically be potentially relevant to the case. Given the type of case involved (alleged misappropriation of trade secrets), those communications would likely be proportional as well as they are critical to the case.
From a collection standpoint, it is an all or nothing scenario when it comes to preserving/collecting text message communications on mobile devices. Since individual text message conversations can’t be exported, the mobile device needs to be forensically imaged and then targeted conversations to be exported from that. Then, if there is any question related to the authenticity of a produced text conversation it can be verified from the original collected image. Screen shots of text messages are not adequate for discovery due to the lack of self-authenticating information.
Determining where a text “conversation” begins and where it ends is difficult and subject to determination. Some conversations could last a few minutes and others could last for days, weeks or even longer. Interspersed with potentially relevant communications could be plenty of personal messages that are not relevant.
While you can be selective regarding targeting which individuals the custodian is communicating with for export, it is important for these conversations to stay intact. Just how the full body of an email may not be relevant it should be produced anyway to keep the conversation in context, except for text interactions outside the scope or privileged communications.
If a party is being “obstructionist”, that might open up the possibility that he or she is deleting text messages or other content. When that happens, forensic collection is necessary.
As is the case with files deleted from a workstation hard drive can likely be recovered since they are merely removed from the index that tracks them, so unless that space is overwritten, they can still be recovered. For mobile devices, this process is much more difficult to achieve, especially without forensic collection.
When a file or artifact (such as a text message) is deleted and can’t be recovered from the physical mobile device itself, it still may be available through a cloud backup, physical backup or a cloud repository with which it syncs.
While recovering deleted artifacts from an Android device may be possible through a “physical acquisition”, that’s not an option for an IOS device. It is important to note that how recently you’ve deleted something and how often you’re using your device affects the ability for it to be recovered. Not all deleted text messages can be recovered, but many of them can depending on the circumstances.
Text messages aren’t the only types of files that might be important or recoverable. File types that can be recovered include:
In a case like this, calls between the defendants and with other relevant parties (such as employees of the competitor), personal calendar events to track meetings with relevant parties, notes about company related topics and even geolocation data (such as a meeting at the competitor’s facility) could be potentially responsive to the case.
According to Elite Content Marketer, the average US adult spends 3 hours and 43 minutes on their mobile devices, so it’s clear that mobile devices are being used by many people for personal and business uses. Depending on the case, one or both uses may be discoverable, so it’s important to consider the importance of discovery of mobile devices and (in many cases) forensic examination or collection of data from those mobile devices is necessary to obtain a complete evidentiary picture. Judge Matthewman’s two rulings in the Measured Wealth Private Client Groupcase illustrate that the courts are recognizing the importance of mobile device forensic discovery as well. For another case showing the importance of mobile device forensics, read here.
To schedule a free computer forensics consultation for your law firm or business, contact Forensic Discovery online or call us at 877-764-0920. Our certified computer forensics experts have helped thousands of clients throughout the country retrieve and preserve digital evidence from our offices in Arizona, California, Colorado, and Texas.
"*" indicates required fields
