How DISCO Forensic Experts Debunked Alleged Spoliation Claims
Outline
Mobile Device SMS Database Analysis
Background
After receiving a spoliation motion related to a contentious employment dispute, a partner specializing in employment law contacted the DISCO Forensics team to help quickly respond. The motion, which included a report from the opposing experts, alleged their client had deleted over 14,000 chat messages.
Iphone Device Collection and Analysis
Results
A certified DISCO Forensic analyst collected text messages from two iPhones and performed a lag analysis to determine whether or not text messages had been deleted. By collecting backup data from the claimant’s iPhone 13, DISCO Forensics leveraged an SQLite database query to show that spoliation clearly did not occur on the newer iPhone 14. Instead, the alleged deleted text messages were an accumulation of deleted messages from each phone.
DISCO provided a detailed report of the findings, and one week after the partner served the opposing side with their expert testimony, the defendant quickly withdrew their motion without further argument.
What's a Lag Analysis?
Mobile device data is now ubiquitous in eDiscovery matters. For some matters, the data that is present on the device isn't the only relevant data. Intel on the data that is missing from the device may be just as relevant. That is where lag analysis can provide crucial information about gaps in communications on custodial devices.
A lag analysis is an advanced forensic technique that involves manually querying the databases where messages reside in the mobile device's file system and creating reports of any messages that are missing. This technique is supported for iOS native messages, Android native messages, and several third-party communication platforms. These reports can show:
Our forensic examiners are also trained to provide consultation on the nuances of what this intelligence means. Are these missing messages proof of user deletion? Could there be other explanations for missing messages? What is the likelihood that these messages could be recovered from other sources? These are important questions that our team can guide you on so you have the full picture of what may have happened on a particular device relevant to your matter.
Why DISCO Forensic Services?
DISCO provides best-in-class technology, services, and consulting under one roof — so we can offer complete outcomes, not just pieces of the ediscovery puzzle. The DISCO Forensics team is comprised of certified experts with a history that includes thousands of collections of different devices and other data sources. Whether remote or onsite, we use advanced techniques and tools to identify and recover artifacts in the search for the truth within the data.
- User activity analysis
- Cell tower data analysis
- Removable storage device attachment history
- Cloud storage and collaboration applications like Slack, Microsoft Teams, WeChat, etc.
- Identification of files copied to removable storage or uploaded to cloud storage locations
- Additional data source identification
Internet history: browser visits, downloaded files, favorites, deleted history
Deleted files recovery and analysis
Email analysis, deletion recovery, and authentication
Chat application archives and logs
Embedded metadata analysis
Custom client request
For more information about DISCO Professional Services, reach out to discodesk@csdisco.com.