In addition to email and chat applications, text messaging is a very common way to communicate in day-to-day business. It has only grown in popularity as remote work continues to thrive and as people look for instant gratification and immediate answers to their questions. In the past, most business communication was done by email. As new modern data sources are used for business communication such as Slack, Discord and Teams, discovery requests that focus on email also need to consider these modern data sources. For purposes of this blog, we will focus on text messages.
The best way to capture text messages is to collect a forensic image directly from the phone. In the past, this was inconvenient at best for the custodian or client. Imagine dropping off your phone to an eDiscovery vendor or forensic technician and not being in control of when your phone is returned. Most phones these days are used for a mix of personal and business reasons; to be without your phone for any amount of time can be extremely difficult. There is now a more convenient method to create a forensic image of an iPhone or Android. The process starts by shipping a collection kit to the owner of the phone. You can then schedule a convenient time for the phone owner to connect their phone to the collection kit and work with a forensic technician who will create a forensic image. Most times the owner of the phone will choose evening hours and let their phone image during the evening or overnight as needed. A typical collection will take anywhere from two to six hours depending on how much data lives on the phone. Once the collection is complete, the custodian will ship the kit back to the forensic technician. All of this happens remotely, and the phone owner always has the phone in their possession.
Do you need to create a forensic image, or is it easier to simply take screen shots from the phone?
Since there is no easy way to capture this potential evidence, many custodians prefer to take screenshots of their relevant text messages instead of creating a forensic image of the phone with a technician. While the answer is, of course you can take screenshots, it may not be a great idea. Verifying that the text message is authentic may be a problem if opposing counsel decides to challenge the screen shot. There are many ways to manipulate a screenshot. Using a software such as Adobe Photoshop or another editing software could easily get the job done.
How long are text messages available? Can I recover deleted text messages?
Phones can be trickier than email to collect from a back-up or from the cloud. Depending on the users settings, messages can be deleted after a certain amount of time or back-ups can be deleted and overwritten. Factors include the phone users settings and the version of iOS they are running.
While there is a chance to recover deleted messages, it’s far from a sure thing. The process can be expensive and would require analysis by a forensic technician. The best option is to preserve the phone and messages as soon as you know that you may need it.
How do you review text messages once collected? Can you upload to an eDiscovery review platform?
There are a few ways to review text messages. Some vendors now have the capability to process modern data which can be uploaded to a review platform such as Reveal or Relativity. Uploading to a platform will allow you to view by thread, day and even with metadata. An advantage of viewing in a platform is that all data sources can be organized, reviewed and produced from one location. It’s possible to view text messages in several other ways including a UFED reader, or PDF and Excel format.
Interested in learning more about how to preserve and collect text messages during discovery? Our local team at Datamine Discovery is here to answer questions. Call 617.329.9530 or contact us at support@dataminediscovery.
By Scott King, Founder, Datamine Discovery
