Tell Us Which Phone and Which Records You Need
A phone used for company work may belong to the employee, the business or another account holder. Before arranging a collection, identify the custodian, device owner, Apple, Samsung or Google account holder and the person authorized to approve access. Counsel should resolve the scope of personal material and any consent or order needed.
Describe the relevant dates, conversations, applications and deadline. Device contents, a cloud backup and provider account records can differ. We identify the sources needed for the question rather than assuming that a phone download includes every linked account.
Remote, On Site or In the Laboratory
Remote collection may be possible for supported devices, backups or authorized account records. On site collection can help when the device must remain with its custodian or coordinated handling is needed. Laboratory work may be appropriate when the method, condition or examination requires controlled access. We confirm feasibility before scheduling.
The available method depends on make, model, operating system, lock state, encryption, app design and access authority. We do not promise remote physical acquisition, universal deleted-message recovery or access to every application. Do not reset, update or change the phone before discussing preservation with the examiner.
Include the Right Cloud Accounts
An Apple or Google account, cloud backup, Microsoft 365 mailbox and messaging application can each hold a different part of the record. Identify whose name each account is registered under, whether MFA is available, which backups exist and whether retention has changed. We discuss authorized account collection separately from the phone method.
For employer-owned or BYOD devices, identify MDM enrollment, work profiles, remote-wipe controls and the administrator. MDM ownership does not by itself establish access authority or make every personal app available. Coordinate any management action with counsel and the collection team.
Keep Messages and Attachments in Context
Relevant material may include available texts, call records, media or WhatsApp and other messaging data. The application, backup and chosen method determine what can be acquired. Conversation participants, attachments, timestamps and time-zone assumptions need to remain understandable after export.
Screenshots can provide a useful starting point but may omit surrounding messages, account identifiers and attachment context. Social Media Collections explains how we distinguish device-held messages from public platform content and authorized account records.
Agree on the Collection Record and Review Handoff
For New York, New Jersey and Connecticut counsel, the delivery discussion starts with the proposed protocol, custodian availability and any stipulation concerning personal content. The handoff can include the agreed extraction or export, a source inventory, method notes, supported integrity checks, custody records and known exceptions.
If the next question is who performed an action or whether content is authentic, that is an examination beyond collection. Mobile device forensics addresses that separate scope. eDiscovery Review Platform prepares agreed material for document review.
Prepare for the Scoping Call
Bring device ownership, backup availability and the collection deadline. Keep passcodes and account credentials out of the inquiry.
- Who owns the phone and its accounts?
Identify company-supplied versus employee-owned devices, the custodian and the registered Apple, Samsung or Google account holder.
- What is available now?
Note the model, OS if known, lock condition, backups, MDM or work profile, relevant applications and who can approve access. Do not put codes or passwords in the inquiry.
- Which records must remain separate?
Tell us the relevant people, date range, personal-content restrictions, production requirements and deadline.
Sources and Further Reading
NIST SP 800-101 Rev. 1: mobile device forensic procedures. NIST describes mobile forensic procedures; it does not establish what can be acquired from a particular handset.