A law firm specializing in complex litigation contacted TCDI for an urgent cell phone forensics project. The attorney managing the case had been working around the clock since being engaged by his client on a rapidly-developing legal matter. During that time, the attorney determined that forensically preserving his client’s iPhone was a critical next step.
The law firm, which had a pre-existing relationship with TCDI, reached out at 2:30 PM to see if a forensic analyst could meet at the client’s residence at 4 PM to preserve the iPhone. Time was of the essence because the iPhone’s owner would be unavailable due to travel starting the very next day. As the forensic analyst was getting ready to leave, TCDI received another call from the attorney with a change of plans. The client was now coming to the law firm’s Cleveland office around 8 PM. It was going to be another all-nighter… TCDI was then asked to meet at the new time and location to preserve the iPhone.
IMPACT
If the phone could not be preserved that day, the client would incur additional preservation costs and be required to ship their phone to a forensics provider. This would leave them without a method of communication for at least two days. In addition, cell phones are continually overwriting data. Depending on the phone’s settings, text messages, call logs, and other important evidence could be set to delete after a specific amount of time (e.g. 30 days). Finally, the attorney was in the process of preparing his client’s case before litigation was filed with the court. The sooner he could access the information on his client’s phone the more time he would have to incorporate it into his legal strategy.
RESOLUTION
TCDI handled all of the logistics following the initial 2:30 PM call, including running the conflicts check, drafting the estimate and agreement, and preparing to immediately dispatch an analyst onsite. Everything was in place to meet with the client, located an hour away, by the requested 4 PM deadline. When the call came in with the change of plans, TCDI coordinated efforts so that the forensic analyst was prepared to meet the attorney and his client at the law firm’s office at 8 PM.
RESULTS
TCDI’s analyst met with the attorney and client at 8 PM and remained at the law firm until almost midnight. While cell phone preservation often takes around two hours, it is largely dependent on the volume of data stored on the phone. This particular phone had a large amount of storage in use, requiring a longer time to copy, monitor and verify the collection. Once the preservation was complete, the analyst took the cell phone data back to TCDI’s forensics lab and began prepping it for the analysis phase. The final report was sent to the attorney less than 24 hours after the analysis phase began.
