By: Steve Davis, Purpose Legal’s VP of Forensics & Investigations and Matthew Rasmussen, Founder & CEO at ModeOne
A prevailing myth exists that you must have a full image (or full physical extraction) of a cell phone to collect defensible data. While full imaging can be a viable method, it isn’t always necessary, efficient, or cost-effective. Let’s explore some alternative ways to collect defensible data from a cell phone, without resorting to full imaging.
What is Full Imaging?
Full imaging refers to the process of making an exact copy of a device’s storage, including all system files, applications, and user data. While this can provide a complete snapshot of a device, it’s often an overkill approach that may introduce unnecessary complexity and costs.
Alternative Methods to Full Imaging
- Logical Extraction: Collect only specific files and data structures, such as text messages, call logs, and contacts. It’s more efficient and faster than full imaging, and it’s a perfect fit when only specific data is relevant to a case.
- Targeted Collections: Selectively capture specific data using keyword searches. It provides a highly focused approach, collecting only what’s necessary, and it’s perfect for compliance investigations where you are looking for specific information.
- Cloud-Based Collections: Access and collect data from cloud backups, such as iCloud or Google Drive. It reduces the need to physically handle the device, making it a great solution when a device is lost, damaged, or remote collection is needed.
- Live Data Collection: Capture data directly from the device while it’s in operation and obtain real-time insights and collect volatile data. This is useful in situations where real-time monitoring or immediate analysis is required.
Key Considerations for Alternative Methods
- Defensibility: Ensure that the method used maintains the integrity of the data and is legally sound.
- Privacy: Consider both the need for information with privacy considerations, especially when handling personal devices.
- Cost: Evaluate the cost-effectiveness of different methods based on the scope and requirements of the case.
- Technology: Utilize specialized software and tools designed to facilitate various collection methods.
In Summary The myth that full imaging is the only viable way to collect defensible data from a cell phone has been debunked by recognizing the value and efficiency of alternative methods. These alternatives provide more focused, cost-effective, and sometimes even more defensible ways to handle the complex task of mobile data collection.