People conduct increasingly more business and personal communications on mobile devices, and litigators now target those devices and the data on them for production. Lawyers need to know what information can be found and produced from a smartphone or tablet so that they can either ask for that information or provide it when requested. There’s more information stored there than meets the eye, including metadata and data that one would think has been deleted.
People use smartphones and tablets for tasks every day, which means there are more types of data stored on these devices than there are on “flip” phones. Plus, the types of data vary based on the user’s apps and preferences. Apps that use location data, including the camera on the device and chat apps like WhatsApp also maintain a record of that information. Photos are automatically geo-tagged when they are taken, unless the user have disabled location information. Even supposedly secure chat apps may leave a record that can be collected from the phone.
Mobile devices keep a plethora of location data. The location of every call is stored because the device has to communicate with cell phone towers. Every Wi-Fi network joined is recorded, along with the date(s) that network was accessed.
One may think that deleting a text message gets rid of the record, but the message and its time stamp may still be collected from a device. Deleted messages are eventually overwritten when that part of the memory is later used for newer messages. Generally, the farther back in time the message was sent, the smaller the chance the digital forensics team will be able to recover it.
Snapchat, which sends messages that “disappear” from the user’s phone after the message is viewed, produces messages that may remain on the device. Even if the image isn’t saved by a screenshot, it may be collected from the device.
The browsing history on mobile devices works similarly to computers: Even if you have deleted your record of past site visits, the full browsing history can be restored. When a user deletes the history, those file records are marked in the database to not display, but they are still kept on the device.