Mobile & Endpoint eDiscovery Collections

What This Solves

A significant share of business communication now happens on phones. Text messages, Signal threads, WhatsApp conversations, and calendar data from a custodian's iPhone may be the most important evidence in the matter. So may the browser history on their work laptop, or the files copied to a USB drive the night before a resignation. Existing backups may contain useful messages, files or application records, but their coverage depends on the platform, settings, encryption and backup date. They do not establish that every relevant record was preserved. Review the available backups alongside the device and cloud sources, and agree preservation steps before changing or resetting a device.

Mobile and endpoint collection needs a validated, source-appropriate method and handling record that can be independently examined. An ordinary backup may be useful evidence when its provenance and contents are documented; a casual file copy can omit metadata or source context. Record the actual method, changes and limits rather than promising freedom from challenge.

For deeper device examination, confirm exact device support, source state and authorized access before accepting the work. Deleted-data recovery or access to encrypted content is conditional; legal permission alone does not establish technical bypass capability.

NIST mobile-forensics guidance

NIST SP 800-101 Revision 1, Guidelines on Mobile Device Forensics, provides technical guidance on validation, preservation, acquisition, examination, analysis and reporting. It is a 2014 publication. Current collection planning must also confirm the actual device, operating-system version, source state and validated tool support.

Method selection follows the question, the records actually accessible and validated support for the exact device. Logical, file-system, physical, backup and cloud methods have different coverage; no method is universally complete, and inaccessible or changed data is documented.

Devices and Platforms Covered

Mobile and endpoint forensics requires different tooling and techniques for each platform, operating system version, and device state. Before accepting a device collection, confirm its model, operating-system version, lock state, available credentials and collection authority. The scope should identify the supported method and the records it can obtain. Some devices or data will remain inaccessible.

• iOS (iPhone and iPad): Logical, advanced logical, and filesystem-level acquisitions using industry-standard tools. iPhone and iPad collection depends on the exact hardware, software version, device state and available access. Confirm current tool support and any required credentials before agreeing to the work; legal authority alone does not make locked data technically accessible.
• Android: Acquisition from Samsung, Google Pixel, LG, and other manufacturers. Android's fragmentation across OS versions and manufacturer customizations requires tool selection and methodology documentation on a per-device basis.
• Windows laptops and desktops: Forensic imaging using write-blocked hardware, producing verified bit-for-bit images in E01 or AFF4 format. Includes both on-site imaging and remote collection for endpoints not accessible in person.
• macOS devices: Forensic imaging with T2 and Apple Silicon security considerations addressed. GDF's analysts understand macOS artifact locations including APFS snapshots, Unified Logs, and the SQLite databases used by Apple applications.
• Tablets and specialized devices: iPad, Surface Pro, Kindle, and other tablet platforms used in business environments.
• Wearables and IoT endpoints: Apple Watch, fitness trackers, and connected devices when their location, activity, or communication data is relevant to the matter.

Remote and Agent-Based Endpoint Collection

Many litigation matters involve custodians in multiple cities or states. Flying a forensic analyst to each location is time-consuming and expensive. For endpoint collections where physical imaging is not required, GDF uses agent-based remote collection tools that extract targeted data sets from Windows and macOS devices over a secure connection, with a full audit trail of what was collected, from which device, and when.

Remote collection does not mean uncontrolled collection. GDF scopes remote collections to specific custodians, date ranges, file types, and directories. Agree the collection window, required custodian assistance, agent installation and removal, and expected effect on the endpoint before work begins. Record collection parameters, completed transfers and exceptions. The operating system and other user activity may change records during a live collection. Every remote collection produces a log file that documents the collection parameters, items collected, and hash values for the output package.

Collection timing is confirmed after checking authority, device and account access, supported method, source size, user or administrator availability and transfer requirements. Urgent preservation and a completed collection or report are different milestones.

Evidence Integrity and Defensibility

The most common attacks on mobile and endpoint collections target three things: write contamination (was the original altered during collection?), authentication (how do you know the image is an exact copy?), and continuity (can you account for where the evidence was at every moment after collection?). GDF's process addresses all three directly.

Use a validated write-blocking method where the source and acquisition method support it. Live mobile, memory and remote collection can change the source; document those changes and the limits of the method. Record appropriate acquisition and file-integrity checks, then verify the collected material at transfer and examination. A matching hash does not establish that every relevant record was collected. Chain-of-custody documentation should account for each material custody transfer from collection through delivery. When expert support is in scope, the assigned examiner can address the documented method, integrity checks and custody record.