Mobile Data Is Everywhere

The amount of mobile data is no longer a future concern; it’s a present reality. Our 2025 Industry Trends Survey showed eDiscovery remaining a top priority for organizations, meaning it is more critical than ever to preserve, collect and recover necessary data.

From photos and videos to app usage and cloud backups, mobile devices now hold incredible amounts of information, but only pieces of that information can prove critical to investigations.

Cellebrite’s Josh Hickman and Andy Jacobs recently talked about best practices and techniques for navigating and conquering the data frontier of eDiscovery, and as you might expect – a successful investigation all starts with setting clear objectives from the beginning.

Setting Yourself Up for Success

“Phones are absolutely an attack surface,” said Josh Hickman, digital investigation expert at Cellebrite. “They track everything – altimeter, speed, networks. If you collect my phone, you’re going to get a ton of memes because I think I’m a hilarious person.”

It’s not merely one phone involved in investigations, one custodian often has a personal phone, work phone, tablet and laptop. That means data is scattered across multiple endpoints and cloud services. “You can just have data literally laying all over the place,” said Jacobs, sales engineer with Cellebrite Enterprise Solutions.

But when it comes to an investigation, not every piece of data on a device is necessary. It’s important, they stress, to take a targeted approach to save your team time and money by collecting data they don’t need. “A little work up front will save you a ton of work on the backside,” Hickman said.

Ask the Question, Trust Your Experts

The saying goes, ‘work smarter, not harder’ and that’s the idea behind using a custodian questionnaire. If you’re looking for a specific piece of information, instead of collecting a huge amount of data, go to the source. “People typically know where they keep their data,” said Hickman. “Even if they’re not very specific, they can at least give you some inkling of an idea about where I need to go to, to do that.”

The questionnaires can also encourage communication between the device custodian, counsel and experts to ensure clarity and efficiency.

Speaking of experts, it’s important to lean on others in the field. Use the network of professionals you’ve built to help guide you through the data collection and analysis process. “Trust your experts,” Jacobs said. “Talk to these people that know these tools.” They can help identify relevant data sources and help you avoid any potential bumps along the way.

To the Left to the Left….

We’ve already touched on the importance of preserving and collecting data. They’re part of the “left side” of the Electronic Discovery Reference Model (EDRM) and while sometimes overlooked, it is essential for defensible and efficient workflows. “Preservation is key in pretty much every case that we run into,” said Jacobs. “Preserve the data in that state and time that’s needed.”

Encryption: The Double-Edged Sword

Encrypted messaging apps are becoming more common and while they can protect user privacy, they can also complicate data collection. Third-party apps like Signal, Telegram and WhatsApp use end-to-end encryption, and newer technologies like RCS are replacing traditional SMS with encrypted messaging.

“I may only get one swing at it,” said Hickman. “If I’m starting to talk about text messages, I’m probably going to go for that full file system because that’s the only way I’ll get the data structures I need.”

These apps are also no longer limited to personal use. “Employees will be using these third-party chat applications to discuss business-related matters. It happens,” Jacobs said.

Deleted data is another challenge. Fortunately, cloud backups often provide a path to recovery.

Key Points to Remember

  • Define clear objectives and use custodian questionnaires to identify relevant data sources.
  • Lean on forensic professionals to guide collection strategies and navigate technical hurdles.
  • Data lives across devices, apps and cloud platforms. Knowing where and how it moves is essential.
  • Encryption and multi-factor authentication are here to stay. Be prepared to address them during collection.

EDiscovery is no longer about merely desktops and emails. Mobile devices, encrypted apps and cloud backups are now a central part of the process. However, with thoughtful scoping, early preservation and expert guidance, legal teams can manage the complexity and uncover the information they need.

Share this post