Collecting cellphone evidence requires specialized skill set
By Kathy Rumleski, AdvocateDaily.com Contributor
Retrieving and preserving potential court evidence from cellphones and other mobile devices requires the specialized skills of a mobile forensics examiner, says Tyler Hatch, founder and CEO of DFI Forensics Inc.
“Mobile forensics is a different breed from computer forensics because these devices pose more of a challenge in terms of obtaining the information stored on them,” says Hatch, who recently received certification as a mobile forensics examiner.
“With cellphones, we are at the mercy of the operating system,” he tells AdvocateDaily.com. “So whatever Android or IOS allows us to look at is pretty much all we see unless we jailbreak the phone.”
Jailbreaking will make a cellphone extremely unstable, Hatch says.
“It voids the warranty and makes them vulnerable in terms of being hacked. It’s not an easy solution by any means,” he says.
There is also a growing need for the services of a mobile forensics examiner because of the interconnectivity of digital assistants — such as Amazon’s Alexa — with other mobile devices such as cellphones and smartwatches.
“Those services are usually linked to a cellphone and synced through that device, he says. “We are seeing a trend toward more mobile, wearable technology,” Hatch says.
Mobile forensics examiners are often called into family law matters following a breakdown in personal relationships, where the people stopped calling and started communicating via text messages instead, he says.
“Those messages can easily be misinterpreted, and problems can arise. We’re often asked to produce records of those text communications to a court,” he says.
DFI Forensics has a current case involving a chatting and mobile communications app, he says.
“We were asked to produce the record of the conversation from the device's chatting app for the court,” Hatch says.
The challenge with providing the conversation is that lawyers can’t just hand the judge a cellphone to see the conversation, he explains.
“We have to provide it in a form that everybody can read and that is a good record of the conversation,” Hatch says.
Along with family disputes, DFI Forensics is often asked to help with workplace issues, Hatch says.
He says most employees have a work cellphone, tablet or laptop, making it easy for them to steal a digital file with private company information or valuable intellectual property.
“An employee might then use that information and start contracting work on the side," Hatch says. “We see a great deal of that.”
If a company suspects an employee is stealing information, it’s important to call in a third party who has the skills required to collect evidence from the worker's mobile device, he says.
“The courts are always trying to balance the privacy rights of the individual versus the commercial rights of the business,” Hatch explains.
If intellectual property theft is suspected, an independent third party can locate the relevant evidence without disclosing the personal information contained on the mobile device, Hatch says.
“We only present the necessary evidence while respecting the privacy rights of the individual,” he says.
Hatch says when it comes to mobile devices in the workplace, employers often opt for a Bring-Your-Own-Device (BYOD) policy, but he advises against that.
“It may be more cost effective for a business to let employees do that, but any potential evidence on that equipment is much more challenging to access — if at all,” he says.
“An employer who owns the device is in a much better position if something goes wrong to take possession of it and get it to us. The company remains in control of that equipment,” Hatch says.