Monthly Archives: January 2024

To-date, most litigation electronic discovery requests are limited to custodian email and loose documents. The requests ignore custodian mobile phone data, in particular stored text messages.  The next big eDiscovery collection trend for litigation will likely be the collection of text messages from mobile phones.

Text messaging is still viewed as something that only teenagers really use. However, the usage data on text messaging is quite revealing. Over 70% of Americans ages 25 to 49 use text messaging. The average number of texts sent per day per user in the US is over 10. In 2008, the number of text messages sent surpassed mobile phone calls. And text messaging is growing at 100 to 200% per year.

To put texting in its proper context, it is estimated that Americans send about 30 emails per day (the data on this is not very precise). This means that texting accounts for ¼ of the daily electronic correspondence sent in the US.

The first step in any forensics investigation is identifying sources of evidence.  Mobile phones store evidence in a variety of locations and media formats. Similar to desktop computers, most cell phones have an internal memory and a removable storage media (SD Cards).  Depending on the carrier, an internal SIM (Security Identity Module) card stores pertinent information, such as phone numbers, contacts, and unique subscriber registration data.

As with computer collections, mobile device collections should be done in a forensically sound manner. This means that the data collected must be collected without changing the original device content. A forensic hash should be performed on the collected data to insure that no subsequent changes are made to the data. Keep in mind that the data on mobile devices is constantly changing (e.g. clock time, network data, etc.) so it is important to make an exact replica as quickly as possible.

The main challenge with mobile collections is that most cellular phones use a proprietary operating system. This is compounded by the fact that new mobile devices are constantly being introduced into the market making it a challenge to stay current on the collections tools. Often the hardest part in the collection is just having the right phone adapter on hand to be able to do the data transfer from the phone to the acquiring computer.

After making a copy of the phone data, the next step is to analyze the data. The forensic tools available for analysis and processing are still in their early stage of development. However, there are a number of forensic tools available such as Paraben’s Device Seizure Toolkit and Guidance Software’s Neutrino.  Paraben’s Device Seizure is probably the most common tool used both by law enforcement as well as for commercial litigation.  These tools are very similar to traditional forensics software utilities and offer many of the same capabilities and functionally, such as text viewing and keyword. During the analysis phase text messages, e-mails and contacts can be identified, undeleted (if necessary), searched, and exported for review or further processing. If you are interested in more information on mobile collections, The National Institute of Standards and Technology (NIST) has a good overview.

Common sense, law school and practical experience all tell a litigator that interviewing a custodian is the best way to identify potential ESI. This made sense when the evidence was in the filing cabinet, but not when it is scattered over network shares and other systems.

Mohawk Industries v. Carpenter is Justice Sonia Sotomayor’s first opinion and while it first appears to be a simple procedural issue, it may have far reaching consequences with counsel making risk vs. cost decisions around their discovery efforts. The case involves a dispute over whether privilege waiver and other discovery related district court orders can be appealed during or after the case, whether it qualifies for an interlocutory appeal in lawyer speak. The unanimous opinion found that with some exceptions discovery decisions could only be appealed after the final judgment was rendered.

Migrated from eDJGroupInc.com. Author: Greg Buckles. Published: 2010-01-26 17:24:21  2009 has been a hard year for corporations of every size. The wave of high publicity eDiscovery sanctions in 2007-2008 had General Counsel’s focusing on reducing discovery risk before the economic down turn. Now they are tasked with cutting departmental budgets and the ever-growing cost of discovery. So we have gone through a dramatic transition [...]

Migrated from eDJGroupInc.com. Author: Greg Buckles. Published: 2010-01-26 17:26:52                  The eDiscovery buzz word these days is ‘ECA’ or Early Case Assessment. But what does that really mean and what software functionality really comprises an ‘ECA solution’? The current Wikipedia definition of ECA appears to focus purely on scanning and generating reports on sources of unstructured ESI to derive an estimate of the potential [...]

As legal technology migrates from external service providers to inside the firewall, it is more important than ever to test and understand your rates of collection, processing, loading, reviewing and producing ESI. Litigation support is a deadline driven business. Counsel will wait as long as possible before pulling the trigger on discovery in the hope and expectation of resolving the matter without having to incur further costs. Successfully adapting to this pressure cooker lifestyle requires that you construct a ‘burst capacity’ workflow as opposed to a normal ‘continuous capacity’ model.

Migrated from eDJGroupInc.com. Author: Barry Murphy. Published: 2010-01-26 23:07:42  If the term Early Case Assessment (ECA) causes you to roll your eyes and reach for a copy of your JD/MBA buzzword bingo sheet, you’re not alone. ECA is a term thrown around by technology providers ranging from email archiving vendors to actual document review vendors.  But, just this once, let the marketing hypesters off [...]

Migrated from eDJGroupInc.com. Author: Barry Murphy. Published: 2010-01-30 13:01:03  Much to my surprise, there are many who believe that the email archiving market is dying fast.  As evidence, they point to:The introduction of Microsoft Exchange 2010 with native archiving capabilitiesThe struggles of pure-play archiving vendors to compete with larger vendors like Symantec and the aforementioned Exchange 2010The substitution of collection appliances and/or search tools [...]

Migrated from eDJGroupInc.com. Author: Barry Murphy. Published: 2010-02-02 06:39:40  LegalTech New York is appropriately scheduled early in the year.  Optimism is high, marketing budgets flush, and sales plans are bullish.  In the past, LegalTech has tended to be blustery.  Too many vendors put out meaningless press releases in an effort to drum up buzz.  Too much of the content focused on law firms (though, [...]

As a result of the potential for significant sanctions, one of the first information governance initiatives organizations seek to implement is legal hold – or litigation hold (yet another example of how much confusing industry jargon is out there). Implemented well, legal hold can help an organization avoid sanctions and improve both the efficacy and efficiency of downstream eDiscovery activities – collection, processing, and review.