Litigator's Guide to Data on Mobile Devices

People conduct increasingly more business and personal communications on mobile devices, and litigators now target those devices and the data on them for production. Lawyers need to know what information can be found and produced from a smartphone or tablet so that they can either ask for that information or provide it when requested. There’s more information stored there than meets the eye, including metadata and data that one would think has been deleted.

Data Available

People use smartphones and tablets for tasks every day, which means there are more types of data stored on these devices than there are on “flip” phones. Plus, the types of data vary based on the user’s apps and preferences. Apps that use location data, including the camera on the device and chat apps like WhatsApp also maintain a record of that information. Photos are automatically geo-tagged when they are taken, unless the user have disabled location information. Even supposedly secure chat apps may leave a record that can be collected from the phone.

Location Information

Mobile devices keep a plethora of location data. The location of every call is stored because the device has to communicate with cell phone towers. Every Wi-Fi network joined is recorded, along with the date(s) that network was accessed.

Messages

One may think that deleting a text message gets rid of the record, but the message and its time stamp may still be collected from a device. Deleted messages are eventually overwritten when that part of the memory is later used for newer messages. Generally, the farther back in time the message was sent, the smaller the chance the digital forensics team will be able to recover it.

Snapchat, which sends messages that “disappear” from the user’s phone after the message is viewed, produces messages that may remain on the device. Even if the image isn’t saved by a screenshot, it may be collected from the device.

Other Data

The browsing history on mobile devices works similarly to computers: Even if you have deleted your record of past site visits, the full browsing history can be restored. When a user deletes the history, those file records are marked in the database to not display, but they are still kept on the device.

_{Copyright © 2016, American Bar Association. All rights reserved. This information or any portion thereof may not be copied or disseminated in any form or by any means or downloaded or stored in an electronic database or retrieval system without the express written consent of the American Bar Association. The views expressed in this article are those of the author(s) and do not necessarily reflect the positions or policies of the American Bar Association, the Section of Litigation, this committee, or the employer(s) of the author(s).}