How to Collect, Preserve, and Produce Text Messages

Okay, so welcome everybody to today's learning objectives webinar, which is how to collect, preserve, and produce text messages from mobile devices. A very specific topic with a speaker who knows his stuff, Brett Burney with Brett Burney Consultants. I've known Brett for, we determined, at least 15, if not longer, years, and we've both been active in the ABA Law Practice Division. I believe I was on your Tech Show board when you were chair of Tech Show.

Yes.

And, and Brett, in addition to being an eDiscovery consultant, also is a lawyer and also has an app. He's a Mac aficionado. So he's also the person I go to for all Mac questions. And he has two podcasts which were in his bio. You've got the Mac in Law. Is that a podcast or a website?

Yeah, so Apps in Law is my blog, and then I have a podcast just on apps in law, which you were on talking about Android devices just a few weeks ago, which was great. So thank you for that.

And then I'll let you say anything else you want to add to this, this interview.

Whatever else you want to add on there.

Yeah. And then so basically we're going to— I'm going to work. I'm recording this. I'll send you all the link to the recording. And some materials that Brett has provided and the PowerPoint, all that good stuff. And if you will, what we're going to do is chat your questions to me, Katherine Reach, so that I can help monitor those for Brett. And then we will, if we have time, we'll open up mics at the end, or you can continue to chat questions. So if it's super pertinent and immediate, I'll ask Brett immediately, and if not, we'll wait till the end. So Brett, why don't you take it away?

Thank you so much. It is an honor to be here. Like Catherine said, we've known each other for many years and it's always wonderful to work together. We usually cross paths at many conferences, which we haven't been able to go to live, at least in person. So it's always fantastic to talk and to share some information, especially as I barely mentioned, I know some of you are just coming in now. Just the fact that that we are talking about this topic is so appropriate. I think this has probably become the number one question that I get today from both lawyers, paralegals, other legal professionals, and how to collect, preserve text messages. I've been doing eDiscovery work for many, many years, and that typically has been working with law firms and how to review documents, right, to know what's relevant and what has to be produced.. And I've also worked with corporate legal departments on how to basically know how to collect the information correctly. And for many, many years, and I guess it still continues to be the primary source of potentially relevant information in litigation matters of all kinds, is still email. We still talk about email today. It is still the number one place that we go to to collect potentially relevant information. And it will probably continue to be, but I would say that over the last maybe 10 to 15 years, we have come to a comfort level on how to collect email, right? And keep it together with the attachments and make sure we can see the conversation threads, all that kind of a thing. And so while that's still important, we still do email. Today, what we are seeing now is the new form as it were, or the hot area— or the most important area today are either text messages. And the other big question I get these days is, of course, how to collect and preserve social media, right? Facebook posts, Twitter posts, Instagram, etc. So we can talk just a little bit about the social media, but today I want to focus on the text messages because it is so prevalent. First of all, it doesn't matter what kind of law that you practice. You are probably going to at some point encounter text messages, right? Even if you're more on the transactional side, which most of you I'm sure are not, but, you know, clients today are almost insisting that this is how they communicate with you. Where we always like to have a paper trail, as it were, you know, through email or something. Today, I find many clients will insist on having a conversation or communicating with their law counsel through text messages. And then of course, if you are involved in litigation, I don't care if you do criminal law, domestic law, bankruptcy, trade secret, huge construction, civil litigation, whatever it is today, you're probably involved text messages, even if you don't think you do, or, you know, oh, you know, we have the emails, they weren't doing text messages. I bet you they were. It is coming up in more and more places today. And I just predict that it will continue to be something that if you haven't involve yourself with yet, you absolutely will. Couple of slides where I pulled from FTI Consulting. Many of you probably know this, but they had a really nice infographic a few years ago where it really just is underscoring some of the information we already know. 90% of workers in the United States are using personal smartphones for work purposes. Probably over the last year, that's even more prevalent than ever. That we're using even our own personal cell phones today to accomplish work purposes, to get access to email, check our calendars, that type of a thing. 67% of people use personal devices for work regardless of whether the workplace has an official BYOD policy. That's bring your own device, right? This is something that a lot of corporations and law firms even have to deal with is how do we allow individual employees to use their personal smartphones for work purposes. Not only that, this is a kind of just a, a quick little infographic as well to give you an idea that we're using mobile devices for more and more access to the information we need. Many of us on the call, I'm sure, like me, like you, we are comfortable sitting in front of a computer, a laptop or a desktop computer. But if you start looking across the rest of the world, as it were, and even maybe your kids and your, your young'uns, as it were, they're not really typically sitting in front of a computer very much anymore these days, right? They get access to all of the information they need on the World Wide Web from their mobile devices, an iPhone or an Android phone, or a Kindle device or an iPad, or frankly, even today, Apple Watches and just having a plethora of avenues to access the information. And in fact, in many countries today, they are predominant. You can see over in Indonesia and India, they predominantly get access to digital information from mobile devices. USA is kind of a little to the right there. About 65% of our total digital minutes are spent on mobile devices. And you know, of course, that's just going to continue to grow and to escalate. And one of the reasons, just quickly, I like to point this out, is because these devices that you see on the screen here that we've always called mobile phones are growing in their capabilities. We've always referred to them as mobile phones, right? We think of them as, well, this is my phone. This is my mobile phone. And oh yeah, I can, I can make some birds angry with the phone, right? Or I can crush some candy if I want to. I can do a couple of other things on my phone. This is my phone. But if you've taken a moment like I have, and probably not because I'm a little bit more of a nerd, but I sit down and I start to think to myself, how many things though has this one device replaced in my life? And I started making a list. Number 1, this is the first device that I pick up to access my email and calendar in the mornings or my task list. It is predominantly becoming a place where I will use to even do Zoom calls sometimes, especially if I'm out. I have it with me all the time. This is exactly how I get my news, my radio feed. It is definitely my most used camera today and a video camera for all the kids and everything. It's How I read books. I have my Kindle app on my iPhone and I read it there. And definitely the way that I get weather. But wait, but wait, there's more. There's a whole other list, especially when we were traveling. I actually just traveled about 3 weeks ago and I didn't print anything out for the flight. I had my flight tracker and my itinerary and my boarding pass all located on my phone. So I was able to use it from there. This is my step tracker. It can do fitness capabilities on there. It is my voice recorder. It's my alarm clock. I don't know about most of you, but that's what I wake up to every day. It's where I get my voicemail. And at the very bottom of that list, it's my map. It's my GPS. I don't even have GPS in my vehicles because I rely on my mobile phones better to do GPS. All of these things can happen. And oh, Oh, by the way, oh, it can also make phone calls. The reason I wanted to spend just a few moments on this is to give you, or to help give you an idea of how powerful these devices are becoming to the point where this is not a phone that can do a few other things. This is today's personal computer. And you need to start thinking about it that way, even with yourself, 'cause I do a lot of mobile ethics training for lawyers.. But you need to think of it that way for your clients as well. This is where a lot of information is being stored that you might need to collect and preserve. Of course, I'm not the only one talking about this. Walt Mossberg used to be the technology columnist for the Wall Street Journal, talked about this a few years ago. 2017 was the 10-year anniversary of the iPhone, and he talked about Apple launching the, uh, iPhone 10 years ago. In 2007 was when the iPhone was announced, And it just keeps getting better, right? Today it has become the new personal computer. And even if you just watched a couple of days ago, you probably saw some headlines. Apple had their developers conference and they're just continuing to make strong improvements to the operating system as it goes. Well, let me give you a little bit of a flavor now from the legal aspect here. I'm not going to go into a whole lot of detail on some of the cases, but Just to give you a flavor of how important this is, several years ago, this is the In Re Perdoxa, a huge multi-district litigation, and of course lots of factors and issues coming up, but I wanted to just highlight some text from this case management order from the judge. One party was trying or attempting to argue that, number one, text messages are a, quote, "less prominent form of communication." So, you know, they're not as important, right? We got all the email, we don't need to do text messages, 'Let's just, you know, call it a day and be done.' And number 2, they said, 'Well, if we had to produce text messages, it would be too burdensome to do so.' Good on them, right? As an effective advocate for your client, you should at least put forth those, uh, those attempts at those arguments there. Well, of course, unfortunately, the judge in this litigation would have none of it. As to the former, text messages are absolutely are electronically stored information. We typically say ESI here, electronically stored information. Doesn't matter that the text message is a less prominent form of communication. There's no question that defendants owe any duty to preserve this material. Now, hopefully many of you are listening to me read that and be like, okay, well, yeah, of course, you know, duh, that's of course the way it should be. But as I said, there are still a lot of people that this could be a legitimate argument that they might want to attempt. The point that I like to put here is that no question, text messages, they are ESI. So if they are relevant, then you have a duty to collect them and preserve them, obviously, on that. And that's what they're going with. So as to the latter there, what about the burden argument? The defendants cannot simply make a unilateral decision regarding the burden of a particular discovery request and then allow the information that is the subject to be destroyed. Obviously, that's a— you can see where this is going. And ultimately, it did result in a pretty hefty sanction here for the defendants here, simply because they just said, well, you know, I— we don't need to do the text messages. Unfortunately, I have no inside information. I didn't work on this matter. But from my experience and working with a lot of other parties, Unfortunately, what I would imagine was going on on the back end is that nobody knew how to preserve those text messages, right? And so it wasn't an intentional, uh, destruction of those text messages. It was probably negligent because nobody took the time to understand it. Again, I have no inside information. I don't know that for sure, but that's just what I suspect based on, uh, my experience. Now, just to give you a flavor quickly, this is, uh, ILTA, who puts out a white paper every year. This is the International Legal Technology Association. And they typically, their membership is usually the very large law firms, AMLAW, 200 law firms. But they asked back in 2016, how many cases have you had to collect and preserve data from a mobile device? Now again, this is 4 or 5 years ago, not very many, right? 28%, 26%. Hey, we've had to collect it all. 1 to 3 cases, about 40%. And then if you look down to the bottom, greater than 20 cases, maybe only about 5%. The same question now about 5 years later: how many times have you had to collect from mobile device? So the 1 to 3 cases decreased a little bit. In other words, it's not just 1 to 3 cases anymore. But if you look down to more than 20 cases there, that more than doubled. In other words, this is something more and more law firms are absolutely having to do. And the last quick little case opinion that I just wanted to direct you to and put some information on here is just to give you a little bit of an idea of the breadth of what information that we're talking about here. This is a case from a few years ago at the Supreme Court, Riley v. California. Unfortunately, and quickly, here's the question. Was the evidence admitted at trial from Riley's cell phone discovered through a search that violated his Fourth Amendment right to be free from unreasonable searches. Mr. Riley unfortunately was in a vehicle that was stopped. It was fairly routine traffic stop from what I could understand. Unfortunately, after searching the car, they found some handguns in it, and Mr. Riley had his personal cell phone on his body. It was in his pocket or something like that. Well, the law enforcement group took that cell phone and they were able to unlock it and get access to text messages. They get access to pictures and the videos which showed, number one, that Mr. Riley was part of, I think it was the Lincoln Park gang out in California. So he was a gang member. They were able to show that from the information on his cell phone. And number two, based on the information from his cell phone pictures, They tied that directly to some other ballistics evidence and other information where they were able to tie Mr. Riley to, um, the scene of a shooting that happened a few days before. So that's the background on this. The points that I wanted to put out: number one, the Supreme Court recognizing this now. A cell phone collects in one place many distinct types of information— the address, the note, prescription, bank statement, video. It reveals much more in combination with all that information than one single isolated record. So it's a little bit different of a mindset than most of us have. We typically go to an email that shows if somebody, you know, made a communication with somebody, or we think of a document as showing a fact, an issue, that kind of a thing. But with a cell phone, so much more information to give a bigger picture. Second, a cell phone's capacity allows one type of information to convey far more than previously possible. So the sum— I like this— the sum of an individual's private life can be reconstructed through 1,000 photographs labeled with dates, locations, and descriptions. I've been involved on matters where we've done exactly this. We can see the process of, like, construction matters, for example. Uh, whoever the foreman that was on the scene of the construction site took pictures, and we could see the evolution of those pictures as they were capturing the information. And then that basically is able to retell that story. Third, the data on a phone can date back to the purchase of the phone or even earlier. Now, that's a little scary, especially these days when we, you know, people can upgrade every 1 year or every 2 years, for example. But a lot of that information is preserved from the cloud services, etc. And finally, there's an element of pervasiveness. That characterizes the cell phones. It's no exaggeration to say that more than 90% of American adults who own a cell phone keep on their person literally a digital record of nearly every aspect of their lives, from the mundane to the intimate. You've seen all the headlines, you know, where people get captured in various poses because they have cell phones. Unfortunately or fortunately, Cell phone coverage has been some predominant evidence, of course, in some recent cases. It's great that we have access to this information as where it is, but I just wanted to give you a little bit of a flavor that even our Supreme Court looks upon this, the totality of this information, as being something that is so important and critical and vital today when it comes to the evidence. So Now let's switch gears. So what, right? Okay, we know why you're here. What then are we looking for on these mobile devices? This is the same little infographic, another sliver of the infographic, to just give you an idea, which of course we already sort of touched upon— the breadth of the information. Call logs, you know, who were you calling at the time? Email, text, the data in individual apps, GPS information. Even on iPhones, there's a whole list. I forget what they— oh, significant locations is what they call it. You can go in and find where the iPhone basically keeps track of where you've been over the last several months sometimes. Photos, videos, we've already talked about voicemails, browsing history. That can be another important component there. Search history, calendars, and more. Now, When I think about data on a mobile device, I usually separate it into 3 different categories here. Phone-specific data, which is information that we can only find on this mobile device. Then app-related data, which is usually on the device, but sometimes that same information could be retrievable from a computer or a cloud server or somewhere else. And then lastly, traditional PC data, that we can find on the phone, but we typically would not capture it from the phone. We go to a different computer or a server. So let me give you some details here to help you understand a little bit more. On phone-specific data, you can see the topic of today's discussion specifically here: text messages, SMS messages, multimedia, MMS. You know, we don't really distinguish between these two text messages these days. We just say text. But multimedia services can include things like video, of course, and pictures, etc. But then we have call logs, voicemails, and contacts. This information, this list here, typically can only be found on the mobile device itself. In other words, there's no other option to find this information. We can't grab it from anywhere else. We have to go to the phone. Does that make sense? So when you compare that with the middle section now, the app-related data, typically this is found on the phone. iMessage messages, that's the iPhone or the iOS equivalent, voice memos, notes, photos, videos, music files, et cetera. This information is found on the phone, but we probably can find this information from another avenue if we needed to. Does that make sense? So for example, you can find photos on the mobile phone,. But I could also go to iCloud.com and download photos from there. Or if you have an Android device, the photos are on the phone, but typically those photos immediately synchronize up to Google Photos, right? So you can go to Google Photos on any computer connected to the internet and download those photos there as well. And then lastly, we have what I call the traditional PC data, only because I'm thinking of it in a PC world. Word documents, PowerPoint presentations, PDF files. Most of this information, of course, it's on the phone, but it's only on the phone because it is pulling that information from a server somewhere, an email server. You can see at the bottom, a calendar server, contacts. We could pull it from the phone, but we typically don't pull it from the phone because it is easier many times to get this information from another location. Example, if we need a Word document on the phone, we could get it off the phone, but I would probably go to Dropbox or OneDrive or somewhere else to find that Word document instead of the one that's on the phone. Now, there's always exceptions to all of these, but hopefully that gives you a little bit of a more specific focus on the kinds of information and the reason why today's topic is so specific on the text messages, because it is really the only source that we have available is on the phone that we have here. And the last little thing I wanted to quickly show to help you understand some of the challenges— they call them problems here, but here are some of the challenges to keep in mind when we are capturing text messages from the phones. Number 1, we typically have to have the device in hand. A lot of people ask me, can we do this remotely, right? Why? Because your client doesn't want to give up their phone. That's really what it comes down to, and I get it. I, I don't blame them one second.. But in order to do these steps that we're going to be going through in a moment, you have to have access to the device. So just know that going in, and know that you should reveal that to your client as soon as possible. They're going to have to give it up at some point, at least for a little while. Number 2, just be aware of the new device types, new encryption. For example, on Monday, Apple, uh, discussed and announced some changes that they are making to the way that the mail apps work on the, on the on the iPhone and the iPad, which involves privacy and encryption, which is all good stuff, but it could affect how some of that information is collected. And then lastly, we've talked about the BYOD privacy and security. Just know that if you're representing even a small corporation, a company of some kind, they may have policies in place, or they may not, that dictate how their individual employees should deal with their mobile devices. Okay, so here now are the 3 methods that I want to talk about today, and this is my non-scientific mobile data collection spectrum. So we're going to start all the way over on, uh, the left here, self-collection with screenshots. Some of you have already done this, right? You know about this. We're going to talk about it a little bit. Then we're going to go to what I call capture on a computer. That'll make sense in a little bit. And then if you want to go to the very other end of the spectrum here, we have what I typically call the forensic collection, which in this case, it can be easy or hard. It is easy because you're going to hire somebody, but it's going to be hard in the sense it's going to cost a little bit more to do that. But these are the 3 options that I want to discuss today, except that I want to briefly discuss a 4th option that I am going to dismiss fairly quickly. Because I get this question all the time. Why don't we just send a subpoena for text messages to Verizon or AT&T or Sprint or T-Mobile or any of these other companies? We got it. No, no, not a problem. We'll just send a subpoena. Why can't we just do that? My first reaction is, best of luck to you. Good luck. I know that this sounds like it should be the most prevalent, the easiest way to go about it. But what I have seen in my experience is most of the time they're not even going to listen to you. In fact, all of these companies are required to deliver what they call a transparency report every year, and they have to list how many subpoenas that they reply to. Most of the time they are more focused on government requests and law enforcement, right? And so for the civil litigation matter, that kind of a thing, It's typically not something, I mean, you're going to be at the bottom of the barrel. Frankly, even if you can find a way how to contact them, most of the time they don't even have a website. You have to call. And it is just a ridiculous runaround. Not to mention the fact that most of these cellular carriers, they don't even keep the messages very long. It's between 3 and 7 days, maybe 10 days if you're lucky, after a message is sent or received, they delete it off of whatever servers in the sky that they're using. It's still on the phone, the individual phone, of course, but the carriers don't have access to this information. And even if you could get some of the information from them, it's usually not going to be a complete record. It might have, like, the phone number of your client, which you already know, and that might be it. There may not be anything else that you can get on there. Sometimes you might be able to get lucky and get it that, uh, sometimes you can't. Now, That said, I'm sure there are some of you on the call that have done this and been successful at it in getting a subpoena. In some cases, I've seen some companies are better than others. It's a little bit of a crapshoot and, and who is going to reply to it, but some people have successfully done it. So it's not something you're going to rule completely out. I just want you to go in with eyes wide open on this, that it's not probably going to be very successful in, uh, what you're doing. So let's go back to my non-scientific mobile data collection spectrum here and go back to the 3 things that I do want to cover that I can give you some power today to be able to know how to be able to collect some of this information. So we're going to start with the easiest and probably the method that some of you have already done with your clients today, and that is what I call the self-collection and using screenshots. So I've got an iPhone, couple of iPhones on the screen here, which I'm gonna guess many of you have, but of course Android can do the same thing. All we're talking about here is using the phone's built-in capability to capture screenshots of information on the phone. Now here, you can see both of these screens have the home screen of the iPhone, but the point is, is that we would open up the Messages app We would find the conversation that you need to collect and preserve, and your client would take a screenshot. Click it. Sometimes the screen flashes and it makes a camera sound on there, right? So what do they do next? Well, they've got the messages here. What they do next is they scroll up to the next few messages, they take another screenshot, scroll up Take another screenshot, scroll up, take another screenshot, rinse and repeat, right? Over and over and over for all of the conversations that you want them to collect and to preserve.

Hey, what happens? Yes, go ahead. Sorry, I had a relevant question. Good.

How do you take a screenshot on the phone? Yeah, okay, so that's a great question. That's exactly what I have on the screen here. So depending on— this is just for iPhone right now. I'm not exactly sure on the Android, but Catherine, I bet you could answer that. But on the iPhone that I have on the screen, depends on what kind of an iPhone that you have. Do you see on the left side there's two arrows, right? There is a home screen button at the very bottom, the round one, and there's a button on the side. We call it the power button. And what you do is you press both buttons at the same time. So try it right now on your own phone. If you have one, or if you have a more recent iPhone that doesn't have a home button on the bottom, what you do is you hit the volume up button and the power button at the same time. So you're basically going in and you're going click, you just click both buttons at the same time. And if you have an iPhone, your screen will flash like a camera flash. And you'll hear a little camera sound, like it's clicking, like a shutter sound on there. Katherine, can you share how to do it on an Android device typically?

Yeah, well, the sad thing is, and I was just typing it up to the person who asked the question, because unlike an iPhone, Android has a lot of flavors. So, Android is an operating system, and then you have manufacturers who make different phones that run the operating system. So, that could be Samsung, Google itself, LG, everybody makes phones. They put the Android operating system on the phone, and then they each create a flavor in favor of the Android operating system. So in terms of how do you do this, most of the time, pretty much like what Brett showed with the iPhone. However, and like for me, I, I can do that. I also have this little side swipey thing on my phone that has a button that I click and it takes a screenshot. So you're going to have to Google how do you take a screenshot and then you have to put in Android version and manufacturer.

Sorry, I wish that was a simpler answer. No, and you did a great job explaining it because you can— most people can tell I don't live in the Android world as much, which is why I go to you for all questions on that many times. But it is true, there are many manufacturers. It's similar to think about it as Windows, right? Microsoft makes the Windows software. They do make a couple of computers, but you can buy a Windows computer from anybody, right? Compaq, Dell, IBM. There's a variety of manufacturers similar to what Catherine is saying. With, with an iPhone, Apple only makes an iPhone, right? So anyway, that just kind of helps give an idea of where it comes from. But it's exactly what Catherine just said. Depending on your client's version or model of their Android device, it will probably change a little bit on how they're going to take a screenshot on there. But it's the same idea. They pull up their messages. Their conversation thread, and they take a screenshot. They scroll up, take another screenshot, scroll up, take another screenshot. And that's exactly what you do— rinse, repeat. Once you're done, your client now has a bunch of screenshots typically sitting in their Photos app. So when you take a screenshot on your device, it immediately puts it into whatever your local Photos app is. On an iPhone, it's called Photos app. On the Android, I think it's something similar, but I know that it typically ties in with Google Photos, right? Because this is a Google device that it has on there. So once your client has all of those photos, then of course they need to get them to you. How do they share them with you? There's several different ways. Uh, so I've seen some clients will simply attach them to an email and send them to the lawyer. I'm not the biggest fan of that method, but it is effective if necessary. But If you have an iPhone, those photos are typically being copied up into the, their iCloud account, so they could share those photos with you, the lawyer, through their iCloud account. Or similarly, if they have a Google device, an Android device, those photos are being saved up into Google Photos. In a similar way, they could share those photos through Google Photos with you, so then you as the lawyer will go to that site and you could download those images. Is there. The problem is you got a bunch of images then at that point. How do you put them together? They're just a bunch of pictures. Maybe that's enough, and maybe at this point that's all you need because you've done your job of preserving the information appropriately. But a couple of other recommendations I just wanted to show you is that once you get those pictures— or frankly, the client could do this as well— then you might want to think about stitching all of those screenshots together. There's two apps that I recommend. One is literally called Stitch It, stitchit, stitchitapp.com. And one of the things that they do is you basically can put all of your screenshots into one long continuous image or PDF. So it looks very simple. It's gonna look exactly like what it looks like on the screen. But of course, you don't have that phone anymore. Because they just took the screenshots, but then now you can produce this PDF that has this tall image on it. You can crop the shots so that, you know, you don't have to see the top and bottom of them. You can align them. You can rearrange them so that the conversation flows correctly. And the other thing that StitchIt has that I like is that you can literally go in and redact certain pieces of information, right? If it's a phone number, for example, which you might need to leave on there for authentication purposes, but you get the point. If it's a name of a minor or something, you can go in and redact some of that information in these screenshots. Now, this is an app that you are gonna put on— you can see it's both iOS and Android. So this is a good one for either way. It's an app that you run on the phone. So you might have to instruct your client to do this as well. There's another one. I think this is only for iPhones, but it's called Tailor, as in like tailoring, you know, stitching and tailoring the screenshots together. Very similar in the way that it works. Apple had just, um, had acknowledged it in their App Store not too long ago. And you can do this with a variety of things, even a Facebook feed, that kind of a thing. And it literally just positions them all together and makes it one long, uh, run-on image there. So again, this then results in an image or a PDF file that you can then produce to the other side. And It's not the prettiest way all the time to, to produce text messages, but it certainly works. It's the least expensive method. Several things to remember on screenshots before we move on to the next one here. Screenshots, as we've been talking about, works on both iPhone and Android. But my biggest but here is please always then document Who made those screenshots and when they made them. I know so many lawyers, they call me and they just want to get the information, but they don't take the time to instruct their client to say, you've got to write down the time you started doing this. You've got to write down— I think my next thing is the model of the device and what operating system is running. To Katherine's point as well, this is even true on the iPhone. We need that information. So you need to document all of that information. Who made the screenshots? When did they make them? What was the model of the phone? What operating system was it running? And then for your purposes, from the legal professional standpoint, you just need to make sure you're comfortable with the fact if those screenshots do or do not include the date or a timestamp or a date stamp on there. That might be something that will come up as a question later on, and that goes back to the authentication of this as well, obviously. Part of the documentation, but all of that information will be helpful there. Okay, so that's it for screenshots. I'll come back to that. Catherine, we got any questions specifically on that right now? We do not. All right, then let's go on to the next one. So we did self-collection screenshots. Now we're going to do capture on a computer. And by the way, I'll just tell you, this is probably my most important recommendation today. If I had to choose on how to tell a lawyer asking me, how do we collect this information, I'm going to tell them this method: capture on a computer. Unless it's something that they don't really, you know, it's not that big of a deal, whether it's the cost or whatever, they can do screenshots. And unless it's something that's a very high-profile case, criminal or elsewise, then it's going to push you to the forensic side. But most of the time, the capture on a computer is going to be what we're looking at. And this is what you need. You're going to need a computer. You're going to have a computer that's going to download and install the software that I'm going to show you in just a minute. So that means either a laptop, Windows or Mac. That means you need to have a computer and you also need to have the USB charging cable for your device, whether it's an Android or an iPhone on here. And possibly you might need an external hard drive. And the reason we'll get into in just a moment. Basically, some of you remember this kind of a picture scenario from way back in the day. Remember when the first iPods came into the world? This is an iPod, not an iPhone, right? It was— it played music. It was a little MP3 music player. If any of you had one of those, how did you get music onto that iPod? Because the iPod wasn't connected to the internet, right? There was no way to connect to the internet or make phone calls or anything. If we wanted to get music onto the iPod, we had to go to a computer, download the music on the computer, right? And then plug the iPod into the computer and copy the music from the computer over to the iPod. Well, We don't have to do that anymore today because frankly, all these devices are connected to the internet and we just download everything, music and movies and everything directly to these devices. But that same construct of manually physically plugging a phone into a computer, it still exists. And this is one of the best ways to collect and preserve text messages. So here's sort of the quick process, an overview of it here. Number 1, you're going to download and install the software on your computer. I'll show you that in just a moment. Number 2, you plug in your iPhone to the computer. This typically works on an iPhone. I'm going to show you on Android in just a moment. Number— step 3, you make a local backup then of your phone, of the contents of your iPhone, to the computer. And you're going to do that. It's very easy through the software I'm going to show you. And then lastly, you can search, find, and then export the text messages that you need. And typically we do this in a PDF format just because it's an easy way to produce the information to the, to the other side. So hopefully that helps the entire— go over the entire process here. Download the computer, the software on a computer, plug in your iPhone, make a local backup. Now that first backup is going to take some time sometimes, and then you have the backup on your computer that you can do a search and to find the relevant pieces of information. Here is my top recommendation for this process today. It is a piece of software called iMazing, sort of like Amazing, but iMazing instead. iMazing.com. Now I've used several of these and I'm going to give you two other recommendations in just a moment as well. And you just have to take my word for it. I find that this is probably the easiest to use, and I think it has the best set of features that can be useful, uh, for an iPhone. And it does a lot of stuff. It's not, it's not built for lawyers, it's built for consumers because it basically allows you to create local backups of your iPhone or your iPad on your computer. You can back up your photos, you can back up your music, you can back up ringtones, you can back up Voicemail, you can back up your calendars, you can transfer files back and forth between your computer and the iPhone. Lots of things that this software does, but of course today we're focused on how does it allow you to collect, copy text messages and conversations off of your iPhone onto your computer. So if you go to imazing.com, you can go into the feature set, you can see how to save the iPhone messages Here is a screenshot of the software running on your computer. It can be Mac or Windows, it doesn't matter. You can see, first of all, in the far left of the screenshot, there are the different sections that you can go into Amy's phone here. The different files, the photos, the WhatsApp here, or we can go to the messages. In the middle column of the screenshot is basically the different conversations that Amy has had with Sarah and Claudio and several other folks. You can click on that just simply the same way that you would click on those messages on your actual iPhone. And when you click on that, then the entire message thread comes up on the far right side. Now again, you're all familiar with this because you do it on your mobile devices, but this is not on the mobile device. This is software running on a Windows computer or a Mac computer, and you are basically able to see all of these messages in that initial backup that you created of your iPhone. But if you look in the top right corner of the screenshot, you can see, sorry, let me get that back up. You can see that there is a way that you can narrow down the date that you want. If you only wanna look for text messages in a certain date, you have the ability to search through these text messages either for a certain word or phrase or a specific recipient. And then you can see one of the items that I've put in a red square there. You can show the time for all messages. In other words, you can apply a date and timestamp to each individual message, which is wonderful because you may not get that information from another way. But iMazing allows you— you don't have to put it on there, but I always recommend that you do because it is good to have that information. And then the last step is you can export it. You can export it as a text file or as an Excel or CSV file. Those are good and they have their purposes, but most of the time people are just going to be going to a PDF export. And here's just a quick little screenshot of exactly what it looks like. Some of you may be saying, well, that looks like my phone. Exactly. That's the point. This is a PDF file though. That somebody used to export the text messages off of the phone onto the computer using the iMazing software. And it looks exactly like what it looks like on the phone, because that's wonderful, right? Not to mention the fact that if you look for each message there, it has a date and timestamp, and it also has the phone number. In this case, they were apparently messaging with Warren Buffett, but it has the exact phone number. And at the very bottom of that, See if you can see, it tells you exactly what iPhone model it was pulled from and what version of iOS that it was on and the date that it was extracted. All of this information is documented for you. This is gold when you are producing this because it's very difficult for somebody to argue this isn't the original. Like, you don't even have to go through the chain of custody, whatever the capability may be. This capability is probably one of the best ways that I have seen to collect text messages from an iPhone. I'll get to Android in a moment. This is from an iPhone, and then be able to preserve it and produce it when you need to. Okay, now iMazing themselves— yeah, another question?

Two questions. Oh good, both relating to the metadata.

And I can, I can barely hear you, Catherine. I know you're talking.

Helps if I pull my microphone down, doesn't it? Okay, so 2 questions about metadata, actually possibly 3 now. Okay. So the first one was, does backing up using the software change the metadata? Then the next one was, do the messages have metadata? And does this apply to messages that have been deleted? And then if client has iPhone and iMac or MacBook, iMessage conversations can easily be downloaded as a single PDF without external software by selecting Print from the iMessage file menu. So that's another method, and I'll paste that to everybody.

Thank you. Okay, give me, give me number 1 again.

So let me go through them quick. Yeah, yeah. All right, so All regarding metadata. Metadata, yes.

Um, the first question is, when you use iMazing to back up, does it change the metadata? No, it does not. That's an excellent question.

It's just doing a full backup. Next. Do messages have metadata? And I might—

we may need clarification. I'm not sure. Yes, in fact, if you look at the screen right now, there is more metadata associated with each message here. But most of the time, when we talk about it from a legal perspective, This is what we care about: the date and timestamp, who you were talking to. Really? Like, what else would you need on there? There is other information, and we can pull that. That, if you start needing some additional information, you're going to need to start going to a forensic aspect, which we'll get to next.

Right.

But the metadata that we have here, yes, is the date and timestamp typically, and the model number, you know, basically the time that it was created, but the time that the message was sent or received.

And then the last one is, does this apply to messages that have been deleted? I suppose if you use iMazing to back up and you deleted the message before you backed it up.

Yes, that scenario, you're exactly correct, Katherine. But if you've never done a backup before and the client comes in and, well, I deleted those messages 2 months ago, you're not going to be able to grab it through iMazing. You may be able to recover it through a forensic project, but there's no guarantee. However, your scenario is absolutely correct, Katherine. If you created a backup on iMazing, and then after that the client deleted that message, you still might be able to get access to the message from the backup on iMazing.

It's also like, I use SMS Backup because I'm an Android. I'm getting there. That runs So, I mean, I guess if you need to forensically examine me, be excited because I'm constantly backing up my text messages. And then there's a whole, hold on now.

Does iMazing work for messaging apps like Telegram or WhatsApp? WhatsApp, yes. That's the main thing. In fact, let me jump out of here and I'll go back to my slide that I have. Up here, this one right here. Can you see that? You see WhatsApp right there on the bottom? So that's about the extent of it though, at least from iMazing. There are some others that can get a little bit more, but with iMazing, it's the messages, which is the iMessages app, and then WhatsApp. If you start going into Snapchat and Telegram and WeChat and some of these others, there are other ways to get it because they basically have their own closed proprietary systems on there. So you may not be able to get it that way.

Okay. And for what it's worth, thank you, Brett. If you ask a question, I will ask Brett. If you make a statement and it's something that you want me to share with everybody, I'm going to share it in the chat.

So that's how I'm handling it. I like it. Okay. And then I'll reserve a few minutes here in just a moment too. We can certainly cover anything. So quickly, I just wanted to show some, and I'll send these slides to everyone afterwards, of course, Katherine, you can send out. But iMazing has an excellent article where they have literally described exactly how you can use their software for iPhone messages and WhatsApp chats. They have a blog on iMazing.com on how to print out some of this information. Oh, by the way, that last comment you made, somebody said you can do a print version of the messages in your iPhone. Absolutely. You can do that. I think on the iPhone, I'm not sure exactly how it is formatted. I've done that from my Messages app on my Mac, for example, because my iPhone synchronizes with my Mac and I can print out my messages from there as well. So that to me is more on the, on the spectrum of like a screenshot, right? Because again, you're still going to have to authenticate where that came from, who made that copy, and you may, may or may not show you all of the metadata associated with date and timestamps on there. But somebody did make that comment and I thought that was great. If you want to see iMazing in action, I'll send you just quickly, a few months ago, I made a video on my blog, absintheLaw.com, where I talked about iMazing and did several things in this, in this video. But the main thing that everybody was most interested in is how to export text messages off of your phone. I send this to a lot of lawyers around. I need to make another video, I think, about this, but it just gives you a better flavor and an idea of exactly how it works. So you can go to AbsintheLaw.com and find the iMazing video video that I did on there as well. I've already mentioned this. iMazing, the software, works on both Mac and Windows, but it only works with iPhones. It only works with iPhones. I'm going to show you Android in just a moment. Of course, it does require physical access to the iPhone and of course the passcode because you plug into the computer with a USB charging cable. And then that first backup may take some time depending on how much information you have on your device. I've seen backups take 10 minutes. I've seen them take 2 hours. It all just depends on how much information that you have on the device. The licenses of iMazing starts at $35, and that's for a single personal license. I've seen some law firms that will do this quite often, that they've got like an enterprise-wide license, so we can get a little more expensive, a little cheaper, depending on how many licenses that, that you need. For that. All right, two other recommendations quickly that I promised I wanted to show you. If you don't like iMazing, which I can't imagine that you wouldn't, but there's another very similar named iExplorer. iExplorer from a company called Macroplant does much of the same thing. You can export the text messages out as PDF or even as a text file there, which is good. And then one other, yeah, Decipher TextMessage or Decipher Tools is the company that has an app called Decipher TextMessage. It's a software that you put it, all of these work the same way. You basically just download the software on your computer, plug in your iPhone, and you can go along with it. They actually also have another very good article on their blog, Decipher Tools. They have a blog about documenting text messages for trial or legal matters. They talk about screenshots, and of course they talk about their Decipher Text Message software and how to do it. So if you want to get a little more information on that, you can, of course. So quickly, before I move on to the forensic side, let's talk about Android. And I know that Katherine knows this because she talked about this so brilliantly on a podcast that I had with her a few weeks ago. This is an app that runs on the Android device. So all of those systems that I was just telling you about mostly work only for the iPhone. But if you have an Android device, This is an excellent app that I recommend you consider and think about for your clients when they have an Android device. So this is an app, it's a free app, or it's only a $5 app, uh, takes out the ads and that kind of a thing, but you can use the free version. So here's the process, and Catherine, you jump in on talking about this too. First, you got to download the SMS Backup and Restore app on your phone. This is not software on a computer, even though I still have that in my title there. This is an app that runs on your Android phone. You then use the app to create a local backup of the messages on your Android phones, exactly what Catherine just said. And then you can upload that backup of your text messages or export it out. Typically, you can connect to Google Drive or Dropbox or something like that, and it creates it in an XML format. Now, the only thing with this XML— some of you might be familiar with HTML. XML is sort of a a, a hyper version of HTML, but it has a lot of information. The file can look a little gnarly if you're not familiar with that, which is fine. SyncTek, the company that makes this SMS Backup and Restore app, actually has a viewer online. It's free. You can just upload that XML file and then it will parse out all of those, uh, text messages from an Android device. Catherine, I know you said you've used this quite a bit. I know that you regularly back up your text messages. Which I think is a fantastic test. The app wasn't designed for legal components. It was designed for exactly what Kathryn does, just to make backups of it from time to time. But it can be useful, and I've used it many times in a legal litigation matter when we need to collect text messages from Android devices.

Yeah, I have. My use case is pretty different in a personal sense. I was actually switching providers and got a new phone. So I got the SMS Backup app, I backed up all my text messages to my Google Drive, got the new phone, got the new SIM card, put it all in, and then reloaded my text messages. Because I— well, unfortunately, a lot of important conversations happen, as much as while we're talking about this, in text. And so I, you know, and then I just kept backing them up because, yeah, it's important. So a question just came in. Okay.

Do you have an opinion about coolmuster.com? Oh, I've, I've used that before. People will ask me about that from time to time. Um, the 3 that I've had in the slides I would recommend first before that one is the best I can do for you there. I've used it before.

I just am not a fan of it.

Okay, fair enough. Okay, good. All right, so a couple of bullet points here, and the last one we won't spend a whole lot of time on, which is, which is fine. The capture on a computer using iMazing or iExplorer or Decipher TextMessage, it only works on an iPhone. Android uses, of course, SMS Backup and Recovery app on their phone. Again, if you're asking me as a consultant, I'm always going to tell you document who made the backup when it was made, where they put it. Make sure you have an accurate chain of custody for all of those procedures. And then of course, just make sure that a copy is actually properly preserved, right? If we have a PDF export, that's great because it's very difficult to manipulate a PDF so that nobody can argue that a change was made after this. But it's just, you need to have a comfort level with being able to accurately preserve that information once it is spit out there. Okay, we've made it now to the end, the other full end of the spectrum, the forensic collection. Hire a professional. Here's the process here. You're gonna find and engage a professional forensic examiner. This is not something that I recommend that you do yourself. If you're at this stage, it's because you've got an extremely high-profile matter. This is something that needs to have everybody involved, and it's worth spending a little bit of extra money on this. To make sure that it is done completely and thoroughly. You're gonna obtain that physical phone, hand it over to that professional, and then you need to specify what information you need the professional to collect from the phone. Now, there are many, many forensic professionals available, not only in North Carolina, but across the country. I don't know this I'd Bailey, but they've got a great little article here How to know when you need a cell phone forensics expert. They talk a little bit about— this is starting to get into that, the geeky side here— but they talk about a logical extraction versus a physical extraction. And this is getting to that one question that somebody had, was a logical extraction is just going to collect the information that you see as a user. It's not going to get all of the deleted information, whereas a physical extraction which doesn't mean that they take the phone apart. It just means that they get access to the root of the device and the information involved in the device. But if they were able to get access to that, then they could potentially, potentially, no guarantee, they could potentially get access to some of the information that may have been deleted. Now, this is from the video from this company, iBailey. This is basically what this is gonna look like. You would never see this screen, but I wanted to give you two screenshots here to get a flavor of what it would look like. Once they do a forensic copy and forensic image of that phone, they will use a tool such as— this is the UFED Viewer from a company called Cellebrite— and they'll find the information. And then this is literally what the text messages look like. It's not as pretty as it was, right? But all of that metadata, all of the information is in there, such as whether the message was read or not, when it was sent, the phone number, all that kind of stuff. And basically then they can export out whatever subset of that information that you need as the legal professional. Now I wanted to show this slide to you not because you're going to go out and buy a copy of Cellebrite, but because you just need to be aware of some of the major tools. I'm not going to give you a recommendation on who to call necessarily. Uh, there's all kinds of different companies across the country that you can call, but when you are talking to them about mobile devices and forensic images, Cellebrite is one of the names that will come up most of the time. NCASE, N-C-A-S-E, NCASE Forensic is another one. There's also Oxygen Forensics and another company called ElcomSoft. Now, there are many other forensic packages available out there, but these are the main ones, and Cellebrite is typically going to be one of the main ones that you're gonna talk to to a professional that is using. Again, they'll need physical access to that phone, which doesn't make clients happy. You need to be specific in describing the information that you need from the phone. And of course, this is gonna cost some money, but having a professional do this work is definitely worth it. So which should you pick? I know we're a minute over time, but quickly, and I'll send these slides to everyone as well. Of course, the answer, you know, from my first day in law school, my real property professor said, it depends. If you're doing a self-collection screenshot, it's the epitome of self-collection. You're going to have to handhold, you know, hold the hand of your client, helping them and helping them understand how to do this. It's the quickest, it's the easiest, it's the cheapest, and it does accomplish that duty of preservation. But you need to make sure you can properly and comfortably authenticate that.

A forensic—

I'm going to go all the way the other side now. Forensic collection, don't attempt to do this on your own. It's going to be expensive, but it might be because it's justified. And of course, this is the most comprehensive and the most thorough collection that you can do. But then, as you know, in the middle, what I would mostly prefer— this is going to be a little bit more work than just doing screenshots, but when you use iMazing on a computer, the iMazing software, it's easier to search, authenticate, produce. Still costs a little bit of money, but not anywhere near as much as what a forensic collection is going to do, and it looks like the messages on your phone, so that makes people a little more comfortable with that. All right, Catherine, I'm going to stop there. I know I'm a minute or two over. There's my contact information if anybody wants some more information, and I'll send these slides to you as soon as we get off here as well.

But thank you, everyone. Thanks, and, um, thanks, Carrie, for, uh, contributing lots of thoughts. And I had another question about the Android In terms of— let's see, for collecting and downloading texts for litigation and family law, do you— besides SMS Backup and Restore, I've also used SMS Organizer, but I don't know what kind of reporting you get just because I haven't played around with it. Are there any other Android tools like that that you know of?

Not that I know of. Honestly, when we talk about this, Katherine, which is why I was so excited on our podcast recording when you mentioned SMS Backup and Restore, it is literally the Swiss Army knife that we use, but mostly for the text messages on there. And I will just say, by the way, though, that the resulting file can be pretty huge. I was working with a firm that the XML file was like 15 gigabytes or so because it scrunches all of those videos and pictures that people send back and forth all the time, the GIF images and everything. All of that is scrunched into that XML file, which is great because it's like a package unto itself, but it can get pretty big.

So sometimes you just have to watch that. Okay. All right, anybody else want to text me a question or chat me a question? Don't text it, please. This, this sounds like a person. This— yes, this sounds like a personal question. Can you permanently delete text messages? Because this person asked previously, um, if I delete them, can they still be discoverable? And we just went through forensics and also possibly subpoena. Um, but is there some way to permanently—

I would say you Signal instead of text message, and then you got no problem, right? Yep, that's exactly the way I would go if you're worried about that. Don't send a text message. Yeah, I've always said in my line of work, I look at it as job security. It's amazing to me what people put in an email message, a text message, or social media, something that they would never say to a person face to face or over the phone, neither of which would ever be recorded. But they'll put it in an email, a text message, a social media post that never gets deleted.

Yep. So Signal is an app. It's a Um, similar to like a WhatsApp chat app, uh, you can actually do video conferencing on your phone through Signal. It is 100% undiscoverable, um, and it was used by Edward Snowden to communicate with his counsel when he was and is still on the run.

It wipes out those communications almost immediately, or whatever time frame that you put in there.

So there's no way to keep it. Yep. So, okay, well, I will stop the recording and thank you so much, Brett. I will send everybody the recording. If Brett wants to hang for half a second and we'll see if we have any more questions, I won't record your voices. So give me just a second and thank you again so much.

Oh, great. I'm looking at the chat. This is great. People were like having a side conversation. I want to read some of the information on here too. Thank you, everyone.