Post on 16-Jan-2016
transcript
Mobile DevicesConcerns with Forensic Capture and Analysis of Portable Data
Today’s Speakers
Helen Marsh of Keker & Van Nest, LLP
Robert Powell of Gallivan, Gallivan & O’Melia, LLC
Dave Rogers of Ernst & Young
Presentation Roadmap
Legal Considerations Practice Tips Technical Considerations
Audience Profile
Corporate – Attorney Corporate – IT or Legal Technology Law Firm – Attorney Law Firm – Litigation Support Paralegal Vendor / Consultant Other
Legal Considerations
Considering Law & Technology when Handling Mobile Devices
Legal Considerations
Recent Case Law Training necessary around preservation and
analysis of electronic data Preservation - Must be Defensible …Have a documented
tracking / acquisition procedure. Analysis - Subjective or Objective? … Just another technical
skill set … but investigation is not same as processing Platform variations can make substantial difference
Practice tips Tip - Preservation may be prudent or required … Analysis
may be unnecessary Tip - Notes Notes Notes and a written report or memo to file
always Tip - Magnum Force “A man’s got to know his limitations …”
Harry Callahan.
The Current Landscape
Mobile device data is the new email Yet it is often still possible for parties to
agree to ignore mobile device data Prior to reaching agreement, preservation
obligation must be considered Privacy considerations are commonly
raised Stored Communications Act may be
asserted as bar
Quon v. Arch Wireless, 9th Cir, 2008
Sherriff’s department contracted with third party for text message service
Department reviewed text messages obtained from provider to determine reason for overages
Found sexually explicit material and attempted to discipline employee
Court held that Stored Communications Act applied
Employee had reasonable expectation of privacy Supreme Court has granted cert
Flagg v. City of Detroit, ED MI, 2008
Allegedly botched murder investigation Relevant text messages to/from city
employees including mayor Court held that Stored Communications
Act could not be used to prevent discovery of relevant text messages via subpoena to carrier
Text messages were effectively in “control” of City even though they had to be obtained from carrier
Southwestern Mechanical Services, Inc. v. Brody, MD FL, 2009
Sanctions were imposed for failure to preserve data on Blackberries
For key time period, devices were not synched with server
Court focused on email, but also text messages, contacts, calendar items, telephone usage records
Southwestern – The Backstory
Theft of trade secrets by employees who left to join competitor
Court issued TRO requiring return of all information and property to former employer
Forensic exam showed that data had been wiped from Blackberries used by two former employees
What’s next
Device technology undergoing rapid improvement
Device usage is increasing and supplanting use of traditional computers
Counsel and courts are becoming more aware of the availability of this data
Forensics tools are improving and costs are coming down
How do we predict trends?
Courts will borrow from experience in law enforcement related matter
Courts will be influenced by frequent use of mobile device data in family law disputes
A few prominently reported decisions will result in rapidly changing expectations
Think the unthinkable
Practice Tips
Real World Challenges with Mobile Devices
Practice Tips
Examples of cases where mobile devices are necessary. (regulatory matters, transferring IP to devices)
Regulatory Investigation - Blackberry E-Mail, IM and SMS Messages validate a pattern and specific instances of ‘leakage’
FCPA Internal Investigation - Overnight Blitz 48 computers and 50 Cell Phones Forensically preserved
ITAR - Multi-Platform Mess during compliance audit Identify relevant information through custodian
interviews Analyze the information you have collected to
determine if there are “gaps”
Know When to Say “When”
Risks of DIY Mobile Device Capture Forensic Tool Spiral - Versions / Functions / Validation
/ New Platforms Reference Materials (Data Sets / Measurement … not
just reference as in Manuals) Sample Size - results and reporting inconsistent on
different platforms and tools Budget and Time Boundaries Cost Recovery of DIY You may not like what you find …
Know When to Say “When”
Risks of DIY Mobile Device Capture Cell Phones are like Ogres … Parfait / Onions / Layers
… (Live Data / Deleted Data / Data Fragments / Unallocated Data / Flash Data / Raw Bytes and oh gosh Device Redundancy)
Economist time … on the other hand, if SMS and JPG / DOC / XLS / PPT / ETC Files are all you seek, this may be easy.
Work directly with technical investigators and communicate the issues of the case
Understand the client’s infrastructure and messaging systems and determine the relevancy of the data on the mobile device (cost benefit analysis)
Understand limits of current technology to preserve and analyze data from these devices
Technical Considerations
Leveraging Available Tools & Identifying Limitations
Audience Survey
Devices Encountered on Cases Blackberry iPhone Windows Mobile Palm Other Smart Phone / PDA Other Phone (Non-PDA)
Technical Considerations
General Methods to handle capture of mobile devices?
Known tool sets for handling mobile devices Options, risks and benefits of mobile devices? How effective is the technology for forensic
capture? How far behind is it? For example, how do you
handle a Droid vs. a mobile device How much residual data, such as deleted data
or internet activity is on a device and how much can be captured and analyzed?
“Isn’t it all on the server?”
Technical Considerations
Most difficult PDAs to capture from Use of social networking tools from PDAs
and developing strategy Cost vs. value of analysis
Questions & Answers