- 0 Comments
I am not a dinosaur. Except that I prefer e-mail to texting, and I forget that my students have never used a record player or lived without the Internet, and I’m not near the national average of 14 daily visits to Facebook. When I need to know how to turn off a nagging dashboard light, I prefer written instructions over YouTube, and I do not video every concert and papal investiture I attend. I still have two landline phone numbers.
Omigosh! That last one. I AM a dinosaur!
According to the U.S. Center for Disease Control, more than 41 percent of American households have no landline phone, relying on wireless service alone. For those between the ages of 25 and 29, two-thirds are wireless only. Per an IDC report sponsored by Facebook, four out of five people start using their smartphones within 15 minutes of waking up and, for most, it’s the very first thing they do, ahead of brushing their teeth or answering nature’s call.
I cite these astonishing statistics to underscore a tendency in e-discovery to seek information in those places where we’ve grown comfortable despite compelling evidence that relevant information is elsewhere. I’ve written on this “Streetlight Effect” before (at page 252 of this collection of articles), in the context of the blind eye long turned to shortcomings of keyword search. The latest manifestation is graver still and will make for a perilous future if we do not rise to the challenge now.
I speak of the rapid accretion of unique, relevant data on mobile devices that has greatly outstripped our ability (or willingness) to preserve and process same. Look around you. Do you see the look-down generation out there? Why do you suppose the person in front of you on the jetway is walking so slowly?
Apple just sold ten million units of its latest iPhone. Ten million. In a week. How many of those purchasers sought a better device for making phone calls? Did Apple even hint it had improved the phone as a phone? No siree, Bob!
More astonishing statistics:
Seventy-one percent of the U.S. population use smartphones. That’s up 40 percentage points in three years. Fifty-seven percent of the U.S. population now use tablets, up 45 percentage points in the same three years.
The implications are clear. Our data isn’t on our desks or in our shares anymore. The fault, dear Brutus, is not in our stars but in the palms of our hands. Yet, we wince to contemplate preservation and collection from mobile devices. We delude ourselves that whatever information is on the phone or tablet is replicated in the sources we don’t ignore. We suppose that, if we must someday deal with dem phones, dem phones, dem iPhones, their contents won’t be much different to preserve and process than stuff on personal computers.
Boy, are we in for a surprise when we hear da word of the cord(less).
We know how to acquire the contents of hard drives. We know about imaging and targeted collection. We’ve gotten good at culling, filtering, and processing PC and server data. After all, most corporate data lives within identical file and messaging systems, and even those scary databases tend to be built on just a handful of well known platforms.
Now, let’s talk mobile.
Let’s talk interfaces. We’ve been acquiring from hard drives for thirty years, using two principal interfaces: PATA and SATA. We’ve been grabbing data over USB for 15 years, and the USB 1, 2 and 3 interfaces all connect the same way with full backward compatibility. But phones and tablets? The plugs change almost annually (30-pin dock? Lightning? Thunderbolt?). The internal protocols change faster still: try six generations of iOS in four years.
Let’s talk encryption. There is content on phones and tablets that we cannot acquire at all as a consequence of unavoidable encryption. Apple lately claims that it has so woven encryption into its latest products that it couldn’t gain access to some content on its products if it tried. The law enforcement community depends on the hacker community to come up with ways to get evidence from iPhones and iPads. What’s wrong with THAT picture?
Let’s talk tools. Anyone can move information off a PC. Disk imaging software is free and easy to use. You can buy a write blocker suitable for forensics work for as little as $27.00. But what have you got that will preserve the contents of an employee’s iPhone or iPad? Are you going to synch it with iTunes? Does iTunes grab all you’re obliged to preserve? If it did (and it doesn’t), what now? How are you going to get that iTunes data into Relativity? There’s no app for that.
Let’s talk time. It takes longer to acquire a 64Gb iPhone than it does to acquire a 640Gb hard drive. Yeah, you heard that right. Moreover, you can acquire several hard drives simultaneously; but, most who own tools to acquire phones can process just one phone at a time. It’s about as non-scalable a workflow as your worst e-discovery nightmare.
Starting to get the picture?
These are hard problems indeed; but, they are not intractable problems. Nor are they solved by pretending phones and tablets are just little PCs or that they simply don’t exist. We must stop kidding ourselves that handhelds don’t hold unique or discoverable information. Look up from your phones and tablets! They are now the center of our digital lives.
Yet, there’s a bright side. The tidal shift to handhelds will make our discovery lives easier because as we move to handhelds and tablets, we inevitably move to the Cloud. The Cloud is in most respects an easier environment in which to identify, preserve, process, search and produce ESI. Okay, you don’t see it that way now. But you will. You will.
Don’t believe me about migration to the Cloud? Try this: Spend some time with your handheld device disconnected from cell and WiFi service. What are you doing? Reading? Listening to music? Playing a game? I’ll tell you what you’re doing: you’re waiting for cell and WiFi service. Your data’s up there and out there. We could use handhelds the way we used desktops and laptops. We just don’t.
So, your challenges for today, Dear Reader (Homework! Now, he’s giving us homework?):
– What’s the difference between a Physical, Logical, and File System (AFC) collection from an iOS device? When do you want one over another? What are the cost considerations?
– It’s 10:00 a.m. The CEO hands you her 128Gb iPhone 6 Plus for preservation and icily asks, “When will I get this back? I’m flying out this afternoon and I NEED IT.” What do you tell her?
– You’ve learned that the information you’re seeking in discovery resides on Samsung Galaxy tablets. What form or forms of production do you specify in your request? What metadata do you need?
Yes, we will be grading on the curve.
About the Author
Craig Ball of Austin is a Board Certified trial lawyer, certified computer forensic examiner, and electronic evidence expert. He’s dedicated his globetrotting career to teaching the bench and bar about forensic technology and trial tactics. After decades trying lawsuits, Craig now limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery and to publishing and lecturing on computer forensics, emerging technologies, digital persuasion, and electronic discovery. Craig writes the award-winning Ball in Your Court column on electronic discovery for Law Technology News and is the author of numerous articles on e-discovery and computer forensics, many available at craigball.com. Craig Ball has consulted or served as the Special Master or testifying expert in computer forensics and electronic discovery in some of the most challenging and well known cases in the U.S.
© Craig Ball 2014. All rights reserved.