Why the Next Message Can Overwrite the One That Matters
Messages, call logs and application activity on a modern phone live in SQLite databases, and a deleted row is rarely erased at once. The record sits in a freelist page or a write ahead log until the application writes enough new data to reclaim the space. That means a phone that keeps receiving mail, chats and notifications after a deletion is steadily overwriting the very rows an examiner would recover, and a connected phone can also receive a remote wipe or a synchronization that replaces its caches. Isolation is the first act for that reason, and the time of isolation is recorded because every artifact on the device is frozen at that moment. Our guide on recovering deleted texts and chat artifacts explains what survives and for how long.
Location records carry their own fragility. Handset caches of recent fixes rotate on short cycles, significant location and visit records are pruned by the operating system, and application data follows each app's own rules. The account side, in Google Timeline and similar services, depends on the user's settings and can be edited or deleted by the user from any signed in device. Vehicle infotainment and telematics modules hold their own tracks, paired phone lists and event logs that are overwritten by continued driving. Each of these sources answers a different question with a different accuracy, and our guide to validating mobile location timelines describes why a map that ignores those differences will not survive an informed challenge. The checklist below treats each source as its own preservation task.
The Order of Isolation, Custody and Account Holds
The handset is isolated first. Airplane mode, with WiFi and Bluetooth confirmed off, is the minimum, and a shielded bag or container is better. Whether the phone is left powered on or switched off is a decision for the examiner, because a powered off device may return to a locked state that limits the extraction while a powered on device drains and must be kept charged. Record the decision and the time. The passcode and any account credentials the custodian is willing to provide are written down, sealed and travel with the device, because a locked device without them may constrain what any method can reach. The phone goes into a labeled bag with a custody form, and nobody unlocks it to look.
Account holds follow immediately, because they protect data the handset may already have lost. The mobile device management administrator suspends any pending wipe, retire or selective wipe action for the device so a queued command does not execute the moment the phone next sees a network. Counsel or the account owner preserves iCloud or Google backups by disabling automatic deletion and refraining from signing in from new devices, because a fresh backup can replace the one that still contains the deleted thread. Where the matter involves location, counsel notes the carrier and the account so records can be requested by subpoena or with the custodian's consent, and the fleet manager is told not to sell, service or reset any vehicle the phone was paired with. Corporate accounts the phone synchronized are placed on hold on the tenant side exactly as described in our digital evidence mistakes resource.
Who Handles the Phone and Who Must Not Unlock It
Counsel decides that preservation is required and documents the instruction, and where the device is personal, counsel negotiates the inspection protocol under which it will be examined. The custodian or the HR representative who receives a company phone performs the isolation and the bagging, records the time and signs the first line of the custody form. The MDM administrator owns the hold on remote commands and the export of the device's enrollment and compliance history, which shows when the phone last checked in and whether a wipe was requested. Counsel or the account owner holds the cloud backups. The examiner, and only the examiner, performs the extraction and documents the tool, the version, the method and what it could and could not reach.
The person who must not unlock the phone is usually the person who most wants to. A manager scrolling through messages creates new read receipts, new database writes and new access times, and an opposing expert will show the court every one of them. A well meaning colleague who takes screenshots of a thread has produced images with no database behind them, and a screenshot is not a substitute for the record it depicts. If someone has already done any of these things, the right response is to stop, write down exactly what was done and when, and tell the examiner so the extraction can account for it rather than be surprised by it.
The Mistakes That Turn a Phone Into a Gap
A factory reset or a trade in is the most complete loss, and it happens most often when a departing employee is allowed to keep the phone through a notice period or when a company device is recycled on schedule. Under Rule 37(e), a phone wiped after a preservation duty attached is a problem counsel has to explain, and the explanation is harder when the company's own process did the wiping. The second mistake is the uncontrolled network. A phone left on a desk with cellular on will receive the next hundred messages, each one claiming space the deleted rows occupied. The third is losing the passcode. An extraction of a locked device can be far more limited than one with the code, and a custodian who later refuses to provide it has changed what the record can show.
Scope mistakes are subtler. A personal phone contains far more than any matter needs, and Rule 26(b)(1) proportionality means collections are scoped to date ranges, participants and applications under a written protocol agreed before the device is touched. Equally, a collection scoped only to messages when the matter turns on location, or only to the handset when the account side holds the longer history, leaves the question unanswered. Counsel and the examiner settle the questions the collection must answer before it begins, and the protocol records them. Our digital forensics process page describes how that scoping conversation runs.
How GDF Collects, Including Remotely, Under the Direction of Counsel
Global Digital Forensics has examined mobile devices for counsel, insurers and corporate security teams since 1992. Veronica Perez leads our mobile and vehicle evidence work and has taught acquisition methods, including JTAG, chip off and in system programming, to other examiners through the California Department of Justice Advanced Training Center and Teel Technologies. The method follows the device: a logical extraction where that is enough, a full file system extraction where deleted message recovery requires reaching the application databases and their write ahead logs, and hardware methods where a device is damaged or old enough to warrant them. Every extraction is hashed, the tool and version are recorded and the report documents what was and was not captured so its conclusions can be traced to a source. Our mobile device forensics page describes these methods.
Where the custodian is cooperative and the matter allows, supported remote collection changes the logistics. The owner connects the phone to a computer and follows a link we provide, the collection runs while we supervise, usually from a few minutes to overnight depending on the device and setup, and the owner normally keeps using the phone afterward. That removes shipping, travel and the handoff risks of a device changing hands, and it means an executive can keep working while the record is preserved. GDF mobile evidence has been accepted in court, and the examiner who performs the collection signs the report and the affidavit and is available to testify. The initial consultation is free. If a phone is about to be reset, reissued or traded in, call (800) 868-8189 before it happens.
The Checklist at a Glance
| Item | Who acts | Where it lives | How fast it expires |
|---|---|---|---|
| The handset | Custodian or HR, airplane mode and power state recorded | Shielded bag or container in a locked cabinet | Deleted rows overwrite as the phone receives new data |
| Passcode and account credentials | Custodian, written and sealed for the examiner | Sealed envelope traveling with the custody form | A locked device without them may limit the extraction |
| Remote wipe and MDM commands | MDM administrator, suspend wipe and retire actions | MDM console such as Intune or Jamf | A queued wipe executes when the phone next sees a network |
| iCloud or Google account backups | Account owner or counsel, no new sign ins | Apple ID or Google account settings | A fresh backup can replace the one that holds the thread |
| Carrier records | Counsel, by subpoena or customer request | The wireless carrier | Retention varies by carrier and record type |
| Messaging application data | Nobody until the examiner, do not open the apps | Application databases on the device | Disappearing message timers run by design |
| Vehicle infotainment and telematics | Fleet manager, no sale, service or reset | Infotainment and telematics modules | Overwritten by continued driving and pairing |
| Chain of custody form | Everyone who touches the device, in order | Paper or PDF traveling with the device | Gaps cannot be filled later |
Request the Formatted Checklist
The formatted checklist and workbook edition, a printable control sheet with isolation time, custody, MDM hold and backup fields for each device, is delivered by a private email link through the request form. Provide your name and email and the link opens the preparation library downloads in your browser. If the device is still connected to a network or a wipe may already be queued, do not wait for the download. Call (800) 868-8189 at any hour and a senior examiner will walk you through isolation and the holds while you are on the phone. The initial consultation is free.