Mixing Business with Personal: A Mobile Device Story

Long gone are the days of needing to be selective about what data to keep on your mobile device.

Combine increased storage capacity with the rise in popularity of BYOD amongst employers, and the volume of data and number of personal devices being collected for eDiscovery matters has increased dramatically, along with the time it takes to collect it.

Apple offers iPhones with a maximum capacity of 2TB (2,000GB) and Google offers the Pixel with a maximum capacity of 1TB (1,000GB), which feels light years away from the Nokia 3310 I had as a teenager, that stored 30 text messages maximum.

Recently the Lineal Forensic Team collected an iPhone, with 1TB capacity, that had only 7GB of free space left. The device owner used this device for business and personal use, documenting his extensive travels with high resolution photos and videos.

The collection took a whopping 17 hours to complete and resulted in 1.8TB (1,800GB) of data, which is the biggest expansion of data volume we’ve seen during collection in recent memory. This is definitely an outlier in terms of collection time and size, but a stark reminder that things are not just like the movies, and that data does not copy in an instant. Balancing the legal needs of the project, custodian schedules and device availability can turn into a very real juggling act, one that requires an element of flexibility on all sides.

Not only are data sizes increasing, based on the storage capacity of the devices themselves, but privacy concerns are increasing too. BYOD is great from both the employee and employer perspective: fewer overheads for the employer and fewer devices to carry for the employee. However, it also increases the privacy concerns around those family conversations and photos of loved ones being handed over to unfamiliar forensics and legal professionals.

With the number of ways to communicate and share experiences with our nearest and dearest constantly on the rise, privacy concerns around the collection of personal devices need to be handled carefully to strike the right balance. Lineal has several workflows that can be used in different situations to help balance the legal need and the privacy concern:

Targeted collection

Where only certain applications have been identified as containing information that may be relevant to the legal matter, it is possible to target only the content of these applications for collection.

The suitability of this collection method can vary depending on the type of legal matter and the types of applications identified.

Full collection and targeted data extraction

Where multiple applications are used for both business and personal communication, Lineal’s forensic consultants can perform a full collection of data from the custodian’s device to ensure the richest set of available data is preserved.

From here it is possible to begin identifying and extracting chat messages, call logs, voicemails and similar content with potentially relevant material, based on input from the custodian and the legal team. This smaller subset is then loaded into the review platform for searching and review by the legal team.

This leaves behind any personal or non-related data, which is not processed into the review platform or reviewed. Depending on the level of privacy concern, this data set can then be deleted right away or at the end of the legal proceedings.

If your organisation needs to preserve, extract or process evidence relating to the use of cell phones or tablets, Lineal’s forensics services team can help. We have the experience, tooling and methodology to handle defensible collections across Apple and Android devices, including collection from encrypted chat applications such as Telegram and Signal. We can deliver the resulting data into various formats for direct processing or loading to your chosen review platform, or transformation via ChatCraft, turning unstructured messaging into easily reviewable threads and making mobile chat as easy to evaluate as traditional emails. Get in touch to discuss your matter or to scope a collection.

__

About Author

Laura Collins is an accomplished digital forensics examiner, currently serving as Vice President of Shared Services & Forensics at Lineal. With extensive experience overseeing global forensic operations, complex investigations, and eDiscovery delivery, she has built her career across corporate, legal, and incident‑response environments. Laura’s background spans hands‑on forensic analysis, major incident response, and leading high‑performing teams to deliver innovative, defensible solutions for clients worldwide. Recognised for her operational leadership and deep technical expertise, she is committed to advancing high‑quality forensic services while driving collaboration, efficiency, and excellence across the organisation.

__

About Lineal 

Lineal is an innovative eDiscovery and legal technology solutions company that empowers law firms and corporations with modern data management and review strategies. Established in 2009, Lineal specializes in comprehensive eDiscovery services, leveraging its proprietary technology suite, Amplify™  to enhance efficiency and accuracy in handling large volumes of electronic data. With a global presence and a team of experienced professionals, Lineal is dedicated to delivering custom-tailored solutions that drive optimal legal outcomes for its clients. For more information, visit lineal.com