5/12/16  

1  

"A compute r lets you make

more mistakes faste r tha n any othe r invention in human histo ry, with the possible exception of handguns and tequila"

M itch Ratliff, Technology Review, 1992

The digital trail left behind by a mobile device user is often present because of "mista kes" attr ibuted to users...

'

5/12/16  

2  

_Ontario,CA vs Quor:: Case 'rt110/v1ng Po/ice

officersPersona/ tex1 messages is heard by £he Us. PSrurvparceym. e Courr. No exPectation of

"Oops" Park

-·

Former Detroit Mayor e Kilpatrick

KTewxatrmn essages to his girlfriend

lead to his removal from office and corruption charges.

'....' Rep Mark Foley· 8 1 a c k 8 e r r y messages to/ from White House Pages c a u s e h i s res1gnauon.

Why Mobile e Discovery is Impo rtant For Lawye rs

@ShoreTel'Sky --

a : a -..... ..... "'• ................21)( \ -....

...

... --,. -... ..........._,

tw(- >f'l-· ... ....

.

....._._,. ,,....--tl-·ll-;!tlP

5/12/16  

3  

How this applies to lawyers Data on Mobile Devices is Discoverabl e

•  Federal Rules for Discovery Apply • The 2006 Amendments RE: "ESI"

The ESI recovered from mobile devices can be Relevant, Unique, and extremely compelling. It can change the course of your entire litigation/investigation.

"Houston, we have a problem."

5/12/16  

4  

" Houston, We Have a Problem."

•  34% of users store sensitive data on their mobile devices.

•  55% of users admit sending work emails and company data to their personal email accounts using a mobile device.

•  89% have mobile devices connected to their company networks.

• Many smart phones are in use outside the reach of corporate IT security controls. Millions of users bringing their own mobile devices (BYOD) into the workplace.

IL. What can lawyers find during eDiscovery fr om a mobi le device?

• Company Email and Webmail • Text Messages • Geographical Location Info/GPS History • Documents and files copied from computers • Internet and Social Media History • Call Logs and Contacts • On-Line Banking Transactions • Calendar Entries • "To-Do" Lists and other Tasks • Photographs and Videos

l l J

5/12/16  

5  

Releva nce? Do Litigation Holds Extend to ESI on Mobile Devices?

Christou vs Beatport

• Company CEO "loses" his cell phone after being served with a litigation hold. • Opponents assert that CEO's cell phone would have provided ESI that was

relevant to the matter, (ie., deleted text messages). •  Judge agrees that "The point is that neither the plaintiffs nor the Court will

ever know." •  "A commercial party represented by experienced and highly sophisticated

counsel cannot disregard the duty to preserve potentially relevant documents when a case like this is filed."

•  Judge admits that there is no evidence that CEO intentionally "lost" his cell phone or that text messages would have necessarily proved to be relevant.

•  Judge orders an adverse inference sanction for failure to preserve text messages.

Show me the Device! dge orders production of mobile devices and

Social Media log-in credentia ls EEOC vs. Original Honeybaked Ham Co.

•  Individuals claim sexual harassment. There are indications that their mobile devices and social medial accounts contain ESI evidence in the case

• Honeybaked attorneys requests access to tho •  udge orders the class participants to produc

ins mitigating

media account log-in credentials • A neutral special master is appointed to examine the devices and the social

media content to determine content rel • The importance of a protocol · judge will review results in camera

ce.

s obile devices a#d social

5/12/16  

6  

Why did Honeybaked work? Strategies f or Mobile Device eDiscovery...

• Persuade the Judge and your opponent that you know

what you are talking about ...understand Mobile Device eDiscovery and the related terms

• Have a thoughtful eDiscovery Protocol in your pocket • Be prepared to counter confidentiality claims with a

suggestion of a "Special Master" to review mobile device ESI in Camera

The Power of a Protoco l... Your opponent will not have one...you must. Components of a Mobile Device eDiscovery Collection Protocol. (Visit our website at www.4Discovery.com for a sample)

• Have a compelling story about why mobile device ESI is relevant, and likely to be discovered on your opponent's devices. (a social media post, a recovered text message?)

• An NDA / confidentiality agreement to counter opponent's objections related to security or privacy and non-related mobile phone data.

• An In Camera review and a Special Master. Handling security & privacy issues

•  Scope of the forensic exam, timeline, costs, etc.

5/12/16  

7  

5/12/16  

8  

Remember The EDRM Model Mobile device ESI is just one other type of Electronically Stored Information ... No difference between a recovered deleted email and a recovered deleted text or photo

• Use this logic to your advantage • Understand that technology exists for the seamless

integration into ESI collected from mobile devices, just like ESI harvested from Exchange Servers, Laptops, etc...

The Mobile Device ESI I e Discovery Interface

eDiscovery Software exists for the integration of ESI Collected into conventional litigation tools for searching, processing, filtering, production, and . review ...

.1- .•_ ·.:_ -.:_·'::'- - '... ..

:.5- ....

.!!. -"!-_'!.

. -- -- ._,_._. . : - ·- --- -·- - - --

iPhonc-Ncku.ps from ielood

ti"' .:?

·· ·. ·-· ·· -·· --

5/12/16  

9  

Main

Tools J Data Views

Device Information

vice Information

lw:J Time

Analysis Social

Analysis

4 10 115 7 11 116

I 274 jtl ; 6

Dictionary

167 \:.z•

9 100 ..... 17 24 " '.

Cookies b::i Notes File

s Call

History Call History

Calendar Contacts Email

MMS

SMS

Corrected Text

Bookmarks

Browser History

Files Data Visualization

levice Information

Emails SMS Items

Conversation 8157918264 X

Conversat ion with josh Fazio

HeyIwas wondering if you got that job?

1/30/2014 6'48:08 PM

Idid!!I'm going to work for both companies for a month before I quit!! Don't say anything!

1/30/2014 6:48:32 PM

Hey Ihate working here can you get me ajob?

1/30/2014 6:50,22 PM

Yes that would be great!!!!

1/30/2014 6:50:40 PM

Pulling SMS out of a cell phone in conversations mode.

For sure!!Start saving all your customer list out to a file!

l/30/2014 6:50i40 PM

Ok great!! Should Isave out all the sell sheets also?

1/30/2014 6:51:32 PM

Ok I'm going to save them to a USB they will never know!!

1/30/2014 6:52:35 PM

A r • · . CHICAGO SUN TIMES • SATURDAY. JUNE 30. 2012

NEws

RACIALANTICS COST $11 IVllLLION::I: _,_.. _.. Noose,graffiti werealleged at trucking firm

ev USA DONOVAN

S1o1ff Repnne1

!Gono;111tJS:1IT'.CUOl1)

Harry Gla!5per cao re- member that day at the end "lt scared 111e• •, .I'm from of 19"JI when he climbed into lbe forldit\. at. woR and a Mississippi ..• and 1knrw noooe was hanging from the what that mtanr Harry

driwr\; 5ide ol Uw wh.ide. "'They bQQg it up right no Inhis fortllft In 1991. ter with a nooite happened cwt•r my l!H.'.<lt,"' .:1ttid Glltl!pcr, in 1991, he aayg th.st he had 57, who 1$AlrieM Amtrican. man1s nooses and racist problems getting promotions 1wti.ng I.hat, it. woukl fSCn•e;l.'j graffiti. comments and car- and new wort assignmem.s a symbol of a C'3.l"eer stalled toons marred the now-closed until he let\. in 2010. ·backward bosses. Chic Ridge terminal WhiJe he had a commer- "It 1><.·arod me- '.\'OU know where t-hey work,('d, accord· dn.I drhl'r'I> license; gradu·

I had nf."\>er entered ingto the HBOC. t1ted tit the top of his class ru:iythlng like lht.d.l'm from "From wh11.t w fc.iuud • .• :tt Tralnoo Inc. proressioo.al Misppi - I V.'<•S IJom lhis would bu.ppm O\'Cr i nd truclt·driving school in Ci· <W.d nU$(',(f in the Soulh and ovtr <lg<lin ru:1d l.JX're was nc> cero and had worted as an 1knew wtu1It.hi1t rm:<'l nt ;he effectn.--e response from the over-the-road trucker h.sul· said. "Th<lt Y>'l\S something compan)' that said 'This is ing new cars across the that. was distutbing to rue not acceptable' or 'Tbis is country for &e\'l'ral )'MTS, he and a little bit frighteni - not allowed,' " said Richard couldn't J<.e& a pollilion as n alot tening" Mrb:ek, the trial att.ome)' for hostler at Yellow. Uut white

Olper. of Park fbrt., the £toe in t.bi3 case. ..So gu)'3 who walkt'Cl into the is among d{)Z(>m> of eWT('ot it kept happening again and pl:tce could get the more lu· <md turco('r croplo)'- 'n:pre- lllg<lin;.1.nd tlg<lin." &ented inl'I fcdcrnl raci<lJ di$. Wbco be rcp<>rtcd the and equipment around the crtmlrn1Uc>n law:\lui :11r.itnlSl noose to his boss, who '9/llS yard,Glasper said. their ooe-.tlme cm1>10)-.:ir, white, Glasper said.thecom· "These guys bad ne\•e.r YeUow Transportation Inc., plaint was brushed aside. drh-en a truck in their li\-es,

freighlAutul.ing compaay "Ivront W my inunl'diate but Uw)' were ,i",t"ttjng lhei;;e Uiat. Inter was folded into suprr.,.isor and s-.ikl 'Hey\ jobs," sll.id Glasper. who what'nuw YRC lw:.

The ease - riled by the I.Tl)' (forklift].' und he told me trucks by hand moet of bis U.S. Eql.&id Bmploym<'nlOp· 'Don'\ worry aOOut lh<il.' and career. pOrlunity Comntii()n ()Jl 'Thcisc v1Xl guyS j1,.1s1. h<'V· The EBOC's race harass- The company's Chicago from trainingto responses to to him splitting up with his behalr or Gl'.lsper nd other ing fun-just take it down ment and discrimination suit Helghts facility faced a sepa- employee C!Omplaints. wife. AMcan.AmcM"tn employ. and put it in the garbage.' " charged that Yellow Trans- rat.e but similar lawsuit that Th.-.t consent decree will "1 think it contributed ees workingatthe company's Glas.per rec:allcL · d that'l> portation Inc.subjected Afri· resulted in a SIO million set· protect emplO)oees involved greatly to my divorce -the Chiocago .Ridge facility -was wb.atldid." can-Aluerica.n employtte.s lo tJement io 2010, a<.wrding to in the Chicago Ri. case. pressure and lbe ho.stile en·

ttlt'd with the rompan)' ror Under tbe lenns or the harmer di!Ciptine and scru· t.heoommisllion . SU million. EEOC o!fJ<iaJ.;; SCU.l•m•nl. llw oompaqy oc- liey 1b1.1l lh•ir wbiW l'OOll· announc.". t-d Fridi.y. Gtaspcr·s <ixpericncc mir- Reach«! at th< CIUCllg<> dillicult and time-consuming prohibited further discrimi· nly Ufe,"Glasper said. counseling. ... Jt. helped me n:i1...:d ll1>l (If (II.he.. Arlil..-un. Heighlls (lmoe, YRC Jne. w.ork as$gnrnents at the Chi· nation but ordettd monitors He said the stress trigo- put thepieces together, but t A.roertrons who say ha representath-e declined to Ca,&O', Ridge fucilit)'.

ijl.l>ptr iaidof finding a

l'.ll(.'body bung tt noooo in largr))• lo<td(·d nnd unluOOcd

t"(:pb no li<ibili&.y.

comment, referring aO call'I to tbe Ohio headquarters.. A mess left. for a man.ager there was not returned.

The lawsuit stems. from incidents that bappeued be· twetn 2(>02' :i.nd 2009, when the Chic:tgo Rid f.acility cloaed, Mrttek said. Up to 324 African-American dock workers, ho.<. rtlers, janitors, clerical workers.supervisors and other staff may be eU· gible to make a claim iu the Sl'ttJement.. WhUe Glar'i=I eneaun·

crath-e job or mmring trnck.'I

te.rpsrts and ga.,-e them more that case, the oourt nat only UndH' a consent decrH in ''Now can gi!ldosuN! on

to keep an f')'e on e\'erything gm.-d st.rite at home and led didn't S.'l\'em)' ntsrrlage."

"'°'

I a dark and turbulent time in ent pe

vironmen" Gl:iRper s.sid. '"I w.uc onthe @<lg@ andadiffer- rson.r sought pastoral

5/12/16  

10  

!Iernng au caus 1eadquarters. A for a manager t retw·ned .tit stems from lt happened be- and 2009, when

Ridge facility ek said. Up to American dock stlers, janitors, ers, supervisors :aff may be eli- e a claim in the isper's encoun- 1oose happened ays that he had ting promotions rk assignments a 2010. had a commer- license; gradu-

top of his class nc. professional

school in Ci- d worked as an :i trucker haul- trS across the :everal years, he a position as a ?llow. But white 1alked into the et the more lu- f moving trucks ent around the r said. uys had never !k in their lives, re getting these

is wort 1000 words.

W here is this stuff? (on the device)

• Internal Memory(RAMandROM) • SIM Card ("Subscriber Identity Module") • Various other devices and computers that the mobile device connects with • Many smart phones will automatically delete and overwrite information when powered on. Use caution when dealing with devices as to not inadvertently destroy data.

5/12/16  

11  

How difficult is it to retrieve deleted data from a mobile device?

• Could data be recovered from a mobile phone submerged in sea water for 8 days?

LIVE

CNN asked us these questions in a recent segment they produced.

5/12/16  

12  

Create Date . 2012:12:06 08:22:49 GPS Latitude Ref .

• North GPS Longitude Ref . . West GPS Altitude Ref . Above

Sea Level GPS Time Stamp . . 14:22:48.6 GPS Img Direction Ref . True North GPS Imq Direction

. 94.21981424 •

Compression .. JPEG (old-style) Thumbnail Offset : 902 Thumbnail Length Image Width

. 8971 • . . 3264 Image Height : 2448 Encoding Process Bits Per Sample

. Baseline OCT, Huffman coding • . . 8 Color ComEonents Y Cb Cr Sub Sampling

. . 3 . . YCbCr4 :2 :0 ( 2 ) A erture . . 2.4 GPS ltitl:!.dEL 188.6 m Above Sea Level GPS Latitude 41 deg 31' 39.00" N GPS Lon_gitude GPS Position Imaqe Size

88 de_g

12' 14.40" w . . 41 deg 31' 39.00" N, 88 deq 12' 14.40" w . . 3264x2448

5/12/16  

13  

Last login : Fri Dec 7 15:15:49 on console joshs-MacBook-Pro:- joshfazio$ exiftool /users/ioshfazio/oesktop/IMG_0875.jpg ExifTool Version Number : 9.08 Pile N : IMG_0875.jpg Directory /Users/joshfazio/Desktop F i l e S i z e File Modification Date/Time

2 . 0 MB 2012:12:06 11:32:47-06:00

File Access Date/ e :2012:12:07 File Inode Change Date/1.!1Jl8 --1. 2012:12:07

15:28:18-06:00 15:28:18-06:00

F i l e P e r m i s s i o n s Pile '.±YPe MIMIE E f

!]!-r--r-- JPEG image/jpeq Big-end an (Motorola,

MM) ke : Appl Camera Kadel Ram. : iPhone QF.!ce _n,.1r.;lt i o n R o t a t e 90 CW X Resolution : 72 Y Resolution : 72 Resolution onit : inches $.91. . . !: - - - - - - ·..1. 6 •0.1

2012:12:06 08:22:49 Modify Date Y Ch Cr Positioning Centered Exposure Time : 1/15 "P Nrumber 2 • 4

5/12/16  

14  

What Trends are we see ing?

• BYOD (Bring Your Own Device) issues are creating risks as users bring personal mobile devices into the workplace with little company control. Security risks, Trade Secret Misappropriation issues

•  Social Media use with mobile devices is prolific. This can expose a company's IP to leakage on the internet

• Many employers are simply "surrendering " on BYOD issues •  The Geo Location / GPS capabilities are creating interesting

eDiscovery possibilities. •  Forensics software and tools are catching up with mobile

device technology • Metadata related to photographs can be compelling evidence.

People are taking millions of photos with these devices daily.

5/12/16  

15  

5/12/16  

16  

Tha nk You!

Questions? Give us a ca l l!

4Discovery info@4discovery. com

312-282-4140

About 4D iscovery 4Discovery is a recognized leader in the Computer Forensics and Electronic Discovery Fiel d and a Provid er of. ..

• Computer Forensics • Electronic Discovery • Data Breach / Cyber Breach Response Services • Continuing Legal Education programs • Information Security Consulting