Anticipation of Litigation Advisor

Preservation of Mobile Device Data in Anticipation of Litigation

June 18, 2018

By: Sarah A. Phipps

Where is your smartphone? Chances are it is in your hand right now, displaying this article on its screen. We use smartphones today more than we use any other digital device. In 2015, a study released by Deloitte¹ reported that Americans collectively were checking their smartphones around 8 billion times per day.² In 2017, Deloitte reported that individual Americans check their phones approximately 46 times per day.³ Our mobile devices have become a large part of our everyday lives. Smartphones have changed the way we get our news, check the weather, and conduct transactions. Generally, these devices have become our main source of entertainment and communication on a day-to-day basis.

Our extensive use of smartphones has turned these small, handheld devices into repositories holding more information about us and our activities than any other device we own. A large part of that information comes from sending and receiving text messages. In 2013, Nielsen determined that, on average, American smartphone users made or received 164.5 telephone calls within a month; yet, users sent or received, on average, more than 764 text messages per month.⁴ Smartphone users are trading voice calls for text messages; however, they seem to be replacing emails with texts, as well. The world’s obsession with mobile devices has propelled litigants into a new era of discovery where we must learn how to effectively and efficiently preserve, store, search, review, and ultimately produce mobile device data.

Because the effort to preserve evidence stored on a smartphone is minimal, a potential “custodian”⁵ should endeavor to preserve mobile content if he or she believes that unique and potentially relevant⁶ information has been created and stored there. Wholesale preservation of a custodian’s mobile device data prevents a custodian from having to determine whether some information contained on his or her smartphone is discoverable; instead, those decisions may be delayed in favor of attorneys who will access, search, and review the previously saved mobile device content.

Considering that the iPhone is one of the most commonly-used smartphones,⁷ this article will walk through the steps of preserving mobile device data through iTunes.⁸ What the custodian needs to conduct and successfully complete a viable back up of his or her mobile device is the iPhone, a USB sync/charge cable, and a computer with the iTunes program installed.⁹ The back up should be completed in less than 30 minutes, during which the custodian can still access and use his or her device, so long as it is not disconnected from the computer. After the back up is completed, for ease of transfer, the custodian should compress the data, which takes less than an hour and is a process that does not need to be monitored.

The steps of an iTunes back up, with credit to attorney and forensic examiner Craig Ball,¹⁰ include:

open iTunes and update the software if necessary;
connect the iPhone to the computer through the use of a USB 2.0 or 3.0 port using the USB charge/sync cable;
if a message asks the custodian to provide the device password or to “Trust This Computer,” the custodian should follow the onscreen prompts;
when the iPhone appears in the iTunes library, click the device’s “Summary” in the sidebar;
in the “Summary” pane, the custodian can chose to run an encrypted or unencrypted back up; for purposes of providing this information to a firm or an attorney to search, review, and produce, the custodian should run an unencrypted back up so that it may be easily accessed by the firm or attorney without using a forensic examiner; and
after the custodian’s back up is complete, he or she should check to ensure it finished successfully by selecting Edit>Preferences>Devices on a computer running Windows, or just Preferences>Devices on a Mac.

To ensure that the back up was saved to the computer’s back up folder, the custodian should navigate to C:\Users\your account name\AppData\Roaming\Apple Computer\MobileSync\Backup\ for Windows users or ~/Library/Application Support/MobileSync/Backup/ for Mac users. For both Windows and Mac users, the back up folder will contain one or more subfolders with randomized 40-character names. Identify the correct back up by selecting the subfolder that has the “last modified” date and time matching the day and time the most recent back up was run. Compress the contents of the back up by right clicking the subfolder and selecting Send to>Compressed (zipped) Folder (for Windows users) or Compress (for Mac users). This “zipped” folder can be transmitted to others via email.

Mobile device data preservation can be crucial to a party’s success in court. In Small v. Univ. Med. Ctr. of So. Nev., 2014 WL 4079507, *5 (D. Nev. Aug. 18, 2014),¹¹ the United States District Court sanctioned University Medical Center of Southern Nevada for its “spoliation” of ESI, including smartphone data, concluding that “[c]ounsel and parties have duties to clearly communicate, cooperate in the discovery process, and undertake an adequate investigation of facts before making representations. These duties arise irrespective of whether relevant evidence is electronic or non-electronic.” Id.at *29. “[I]gnorance of technology,” wrote the court, “does not excuse counsel or clients from carrying out their duties to preserve and produce ESI.” Id. Indeed, it is well-settled in federal civil litigation that “[o]nce a party reasonably anticipates litigation, it must suspend its routine document retention/destruction policy and put in place a ‘litigation hold’ to ensure the preservation of relevant documents.” Zubulake v. UBS Warburg, LLC, 220 F.R.D. 212, 218 (S.D.N.Y. 2003) (internal quotations omitted) (finding that an entity or individual’s duty to preserve is an affirmative duty and requires active involvement of parties, which includes the communication of preservation obligations to possible custodians); see also, In re Napster, Inc. Copyright Litig., 462 F. Supp. 2d 1060, 1070 (N.D. Cal. 2006).

Preserving the data on a custodian’s smartphone by periodically¹² backing up the device through a simple and cost-effective process should be the norm where mobile devices contain more information about people’s activities than any other device. Potential litigants must embrace the idea that mobile device data will hereafter be the subject of routine discovery requests during litigation.

“Deloitte” is the name under which thousands of individuals and firms “collaborate to provide audit & assurance, consulting, risk and financial advisory, risk management, tax, and related services to select clients.” About Deloitte, DELOITTE.COM, https://www2.deloitte.com/us/en/pages/about-deloitte/articles/about-deloitte.html (last visited June 13, 2018).
See Eadicicco, L., Americans Check Their Phones 8 Billion Times a Day, TIME.COM, http://time.com/4147614/smartphone-usage-us-2015/ (last visited June 14, 2018).
Analysis, Global Mobile Consumer Survey: US Edition, DELOITTE.COM, https://www2.deloitte.com/us/en/pages/ technology-media-and telecommunications/articles/global-mobile-consumer-survey-us-edition.html#form, at 19 (last visited June 13, 2018).
See The Mobile Consumer: A Global Snapshot, NIELSEN.COM http://www.nielsen.com/content/dam/corporate/us/en/reports-downloads/2013%20Reports/Mobile-Consumer-Report-2013.pdf, at 19 (last visited June 13, 2018).
The Electronic Discovery Reference Model (EDRM) defines a custodian as a “[p]erson having administrative control of a document or electronic file; for example, the data custodian of an email is the owner of the mailbox which contains the message.” See Data Custodian, EDRM.NET, https://www.edrm.net/glossary/data-custodian/ (last visited June 14, 2018) (citing Fios, EDiscovery Glossary), Here, the custodian would be the owner of the smartphone.
“Evidence is relevant if: (a) it has a tendency to make a fact more or less probable than it would be without the evidence; and (b) the fact is of consequence in determining the action.” Fed. R. Evid. 401.
The iPhone 6 is currently the world’s best-selling smartphone, with over 220 million devices sold. In the first quarter of 2018 alone, the iPhone X was the best-selling smartphone. See generally Kharpal, A., Apple’s iPhone X Was the World’s Best-Selling Smartphone in the Last Quarter, Research Shows, CNBC.COM, https://www.cnbc. com/2018/05/04/apple-iphone-x-best-selling-smartphone-in-first-quarter.html (last visited June 12, 2018).
For users of different smartphones, back ups of mobile device data can also be achieved through use of online repositories. However, recovering that information can be difficult.
However, the computer must have unused storage space on its (C:) Drive that exceeds twice the amount of the iPhone’s storage capacity to run and successfully complete a back up of the mobile device.
See generally Ball, C., Custodian-Directed Preservation of iPhone Content: Simple. Scalable. Proportional, CRAIGBALL.COM, http://www.craigball.com/mobile_preservation_method_FINAL.pdf (last visited June 14, 2018).
Id. (finding University Medical Center of Southern Nevada’s (“UMC”) mobile preservation efforts were insufficient, specifically concluding that “UMC’s prior and current counsel failed to conduct timely custodian interviews, leading to the failure to identify key evidence repositories resulting in the destruction of significant amounts of responsive ESI”); see also id. at *27 (finding that UMC failed to act reasonably when it was aware that litigation was forthcoming, allowing some custodians to “wipe” their smartphones, including thousands of text messages, “just prior to UMC’s production of mobile phone data”).
The obligation to preserve is a continuing obligation, which may persist until applicable appeal periods have run.

Attorneys