This site uses cookies to provide you with a more responsive and personalized service. By using this site you agree to our use of cookies. Please read our cookie notice for more information on the cookies we use and how to delete or block them.

Bookmark Email Print this page

5 Questions About Mobile Device Discovery and Investigations

Discovery Insights


An interview with Matt Larson, principal, Discovery, Deloitte Financial Advisory Services LLP.

With the proliferation of mobile devices in use today and the increased penetration of mobile devices and tablets into everyday life, mobile devices and tablets should be considered in every eDiscovery effort.

Questions Matt Larson's take
Why is it time to accept the fact that mobile devices are a real source of relevant data in discovery and investigations? Ninety percent of all Americans have a mobile device; fifty percent of Americans have a smart phone.1 Mobile devices contain, in some cases, more data types than in traditional computers. Mobile devices are not just phones; they are mobile computers, text devices, cameras and more. Mobile devices intentionally or unintentionally contain a record of peoples’ lives. Just as computer data has been critical in litigation matters in the past, data from mobile device applications, photographs, and text messages can be more valuable than ever before. A complete capture of mobile device data and any backups, such as those from iTunes or from Blackberry devices, provide an essential part of the electronic data collection for every custodian.
Mobile forensics has been around for some time, but what has new technology enabled companies to do in discovery and investigations? Mobile device forensics has continued to evolve with the change from cell phone to smart phone. Today, we efficiently deal with over twenty-one data types such as text messages, voicemail and call logs. Some of these data types will actually contain geographic locations. We are able to process Gigabytes of data which could yield relevant information. Further, we have the ability to exploit new technologies to automate the conversion of thousands of lines of data extracted from a mobile device into individual files or a load file, which can be ingested for hosting, review, and then ultimately produced by counsel.
What challenges does mobile device discovery bring vs. traditional discovery? Both mobile device forensics and traditional forensics typically deal with four principal operating systems and a near exponential increase in data size. However, unlike traditional PC forensics, mobile device forensics must address a plethora of changing configurations that lack industry standards, as well as a very short development cycle for updated operating systems. Maintaining quality and efficiency with such short life cycles is the challenge that sets mobile device forensics apart.
How does my company's mobile device policy affect discovery? Corporate mobile device policies, including the use of Mobile Device Management (MDM) software and the move to Bring Your Own Device (BYOD) have impacted discovery in subtle, yet profound ways. The decision to deploy MDM provides essential security, an inherent, in-depth inventory system, and a potential collection platform. BYOD, while it typically saves money and increases job satisfaction, it also typically complicates security and discovery by introducing a heterogeneous mobile environment, fostering increased personal use and complicating collection, review and redaction of mobile data.
What are some actionable items to take to be prepared for mobile device discovery? Essential to any discovery matter or investigation is the involvement of all parties in advance planning including management, legal and technical personnel. First, establish an inventory of devices. It can be as simple as keeping a spreadsheet or downloading a list from your MDM of devices and custodians. Second, ensure you have written policies and procedures in place that cover the data types found on mobile devices, but that are generic enough to anticipate new applications as they arise. Lastly, the move to BYOD brings both of these steps into sharp focus. In a BYOD environment both an inventory of devices and up to date written policies and procedures are essential.

My take: Mobile device discovery will become commonplace to traditional electronic discovery and investigations 

Mobile device discovery will continue to change with the evolution and proliferation of these devices. The increased penetration of mobile devices into our lifestyle will propel them into the discovery and investigation practices. The value of the data that can only be found on the mobile devices will continue to rise. These factors will inevitably move mobile device data into commonplace electronic discovery and investigations.

Click here to download the interview.


1 Aaron Smith, Smartphone Ownership-2013 Update, (June 2013)


As used in this document, “Deloitte” means Deloitte LLP and its subsidiaries. Please see for a detailed description of the legal structure of Deloitte LLP and its subsidiaries. Certain services may not be available to attest clients under the rules and regulations of public accounting.


Related links

Share this page

Email this Send to LinkedIn Send to Facebook Tweet this More sharing options

Stay connected