Loading... Please Wait!

The Forensicators Present ... Soft Skills: Experience Matters


Ken Marchese

Sr. Managing Consultant
Read Bio...

By now, many people have been exposed to the admonition, “Dance like no one is watching; email like it may one day be read aloud in a deposition.”[1] Unfortunately, the core concept behind that saying has not been adopted by many mobile device users. iDS is regularly called upon to image a device belonging to a key player in a litigation. While some of these custodians are veterans of the corporate world and do not lack in experience or confidence, when faced with the prospect of imaging their mobile devices, the first question from many is a rather sheepish, “Can you really see everything?”

Well, yes, we can see most everything on the device, including personal content that you may be reluctant to share. Modern devices tend to hold onto content much longer than you would expect, so even data you thought was deleted may be located and imaged.

What happens next is an important aspect of “Forensication” that is rarely, if ever, covered in any training, yet can significantly impact the outcome of a case. Our fearless investigator must convince the semi-willing custodian to hand over what he or she considers priceless and potentially highly confidential information that could significantly impact their lives. And all this must be done before the custodian’s next meeting.

What my iDS colleagues and I have developed over time is a soft approach designed to ease the fears of a custodian, while respecting the needs and timeline of the litigation. The discussion usually starts like this: “I understand your concern. I would not be pleased if it were my phone that needed to be handed over and copied, either. Let me explain to you what I am doing and how the content will be handled to help ease some of your concerns.”

This approach is necessary because most tools we use to collect data from mobile devices do not lend themselves to the creation of a partial or logical image (e.g. collecting only what is asked for), which are standard when dealing with laptops or desktops. I don’t think there is a technological reason for this and there are only a few methods one could use to, theoretically, create a partial “image.” So, we usually must collect everything on the mobile device, even if counsel is only looking for, say, two specific text messages.

That said, there are advantages to having an image of the entire device. If the case contours shift and new issues arise, important evidence is already preserved, eliminating the need to once again collect data from that device. Additionally, the context around information can be very important. As an example, say we collect data from party A’s phone. If all text messages from party A to party B are produced from that device, yet none are shown prior to a certain date even though both parties claim they were sent, what does that mean? The phone image can put that in context, in this case most likely proving that the device imaged was put into service after the date in question.

All of this leads to the central point: effective investigations often involve soft skills favoring more experienced investigators. By keeping the focus on only relevant facts, and respecting the privacy of custodians, iDS is able to accomplish the sometimes-contradictory goals of obtaining the required information while caring about, and not needlessly invading, the device user’s privacy. 



To access previous blog posts from The Forensicators, please CLICK HERE.


Please email Mr. Marchese at kmarchese@idiscoverysolutions.com to learn more about how iDS' experienced forensics team can assist with collections, as well as how the experts at iDS can help with all your legal technology needs on your next case or internal investigation.


The opinions reflected in this post are solely those of the author, are for educational purposes to provide general information, and do not necessarily represent the views of iDiscovery Solutions (iDS), nor any current or former employee of iDS. Moreover, any references to specific litigation or investigation work or findings are fact-specific. The Forensicators blog should not be used as a substitute for competent legal advice. 

Download Keys to Today’s Information Governance Landscape