iPhone Date Stamps

iPhone text messages may be produced as screenshots, rather than being processed with mobile discovery software that collects their metadata. As iPhone users will have noticed, the Message app does not display the time and date of each message. Rather the date will be inserted at different points in a series of messages.

When scrolling through such screenshots, note that a new datestamp should be added each time a new text is sent between two or more recipients after the beginning of a new day.

Ball on Discovery from Mobile Devices

This past October, Craig Ball, an electronic discovery special master and a professor at the University of Texas at Austin, published a succinct guide to electronic discovery from mobile devices, Mobile to the Mainstream. Here's an even more succinct summary of the guide.

The average user of a smartphone spends 4 hours on the device each day. Two-thirds of all emails are sent using phones. Ball criticizes lawyers for treating mobile phones as devices that are only used for making phone calls. Smartphones do not necessarily need to receive special forensic reviews. Only active data should be collected, not latent artifacts. A cheap tool can be used to collect documents, spreadsheets, and presentations from mobile phones. Photos and videos can be collected with ease. Photos will be stored on most mobile devices in High Efficiency Image File Format. This files will have an .heic extension. Many e-discovery tools can't support this format.

Text messages are used for digital communications more frequently than emails. Unless the default setting is changed, an iPhone will keep its text messages indefinitely. Exporting messages and their attachments is not burdensome. The encoding should be changed to Unicode UTF-8 to capture emojis. An iPhone's call history and voicemail metadata can also be easily exported. Mobile calendar data is easier to export and redact than the same type of data found in .pst archives.

Data from apps can be stored as JSON, PLIST and SQLITE files. Geolocation data may be difficult to collect and review even if a user can access it easily. Federal law requires phones to broadcast their location in order to facilitate responses to emergency calls. Apple protects geolocation data and won't allow for a bulk export of the data. This data is also not backed up or stored in iCloud.

Ball has not been able to find a forensic tool that can collect data from multiple images of multiple smartphone simultaneously. He has used a $50 tool called iMazing effectively in mobile e-discovery. His mobile discovery scorecard tracks the difficulty of collecting and reviewing different types of evidence, and its potential relevance.

District of Rhode Island Ruling on Seizure and Search of iPhone

On Monday, Judge William E. Smith denied a motion to suppress evidence seized in a search of the Defendant's iPhone 5 by a local police department. See, United States v. Gomes, Cr. No. 17-39-02, 2018 U.S. Dist. LEXIS 113181 (D.R.I. July 9, 2018). The Defendant was charged with sex trafficking minors.

The government argued that it had probable cause to believe that the Defendant's cell phone was used in a crime because he was seen using the phone in a car while driving a minor to a location where she was to engage in criminal sexual activity.

"Officer Corvese's observation of Gomes using his cellphone while occupying a car connected to criminal activity was sufficient for the officer to form a reasonable belief that the cellphone could provide valuable incriminating information. To ensure that Gomes did not attempt to conceal the phone, which was evidence in an ongoing investigation, Officer Corvese had the lawful authority to seize it. Thus, the officer's seizure of Gomes's iPhone incident to his arrest was constitutional." Id. at 15-16.

The phone was seized during an unlawful entry. The police subsequently obtained warrants to search the phone. They were only able to unlock the phone after getting a federal search warrant, after first not being able to search the phone with a state warrant. An interview with the victim gave the police independent grounds to search the phone, and made the inevitable discovery doctrine applicable. There was a clear exception to the exclusionary rule.

The Court also disagreed with the Defendant that the police's waiting three days after the seizure of the phone to obtain a search warrant was a violation of his rights under the Fourth Amendment. Judge Smith ruled that the three day period necessary to obtain the warrant was permitted. "the Court must balance law enforcement's concerns for preserving evidence against Gomes's privacy interest." Id. at *23.