Ten years ago a forensic examination meant a desktop computer’s hard drive. Today the most important evidence in a divorce, a fraud or an employment dispute is usually in someone’s pocket, in a cloud account, or in the dashboard of a car.
What can be recovered
- Messages and call logs, including some that were deleted, depending on the phone and how much time has passed.
- Location history, from the phone itself, from apps, and from photos that record where they were taken.
- Photos and videos, with the date, time and device that created them.
- App activity: when an app was installed, opened and used.
- Cloud backups, which often hold older copies of data no longer on the device.
- Vehicle data. Many cars record which phones connected, the calls made through the car, and the destinations entered.
“Disappearing” does not always mean gone
Messages set to delete themselves vanish from the conversation. They may survive in a backup, in a notification log, or on the other person’s device. No examiner can promise recovery, but assuming the evidence is gone is often a mistake.
If you think you will need the evidence
- Stop using the device as far as you can. Every hour of normal use overwrites recoverable data.
- Do not reset it, update it or “look around.” Opening files changes the dates that prove when they were last touched.
- Keep it charged and note the passcode. A locked phone with a forgotten code is far harder to examine.
- Leave cloud accounts alone. Do not delete, tidy or change settings.
- Call your attorney early. Phone carriers and online services keep records for limited periods, and a preservation letter has to arrive before the data is purged.
One limit that matters
You can have a device examined if it is yours or you have legal authority over it. A spouse’s or employee’s personal phone is a different matter, and evidence taken without authority can be thrown out and can expose you to liability. Ask counsel first.
PMR Group International examines phones, computers, cloud backups and vehicle systems and documents the results for court. See our cyber forensics service, and contact us before the evidence changes.
