Forensically Collecting Instant Messages for Litigation
With billions of monthly active users, the growth of instant messaging apps has had a profound impact on litigation. Many demographic segments prefer instant messaging over email and rely on it as a primary mode of communication. Instant messages deliver instant gratification, are often less formal, contain emojis, and have greater sentiment variability than email. Due to this combination of factors, we’re seeing strong growth in forensic collections of instant messages for client cases.
While WhatsApp, Facebook Messenger, and Snapchat are frequent sources of evidence in consumer-focused matters, Microsoft Teams, Slack, Cisco Jabber, and Google Hangouts are frequently collected for business focused litigation. However, with bring your own device (BYOD) programs, we often find that corporate and personal domains have been commingled, with relevant messages appearing across messaging apps.
There are hundreds of apps that have instant messaging capabilities, including social media platforms, customer support platforms, and the native messaging apps on mobile devices like Android Messages and Apple’s iMessage. Utilizing a data map during custodian interviews is instrumental in identifying the instant messaging apps that need to be targeted for forensic collections, so you don’t miss critical evidence.
At Lexbe, we’ll work with you to assess the specific requirements of the forensic collection needed to obtain the evidence that’s relevant to your case. There are important variables that need to be considered when collecting instant messages. Depending on the device and the instant messaging app, some messages can be collected remotely from a backup of the device or directly from the cloud. Other instances require a physical collection from the device.
Smartphones typically have robust encryption and therefore we utilize tools like Cellebrite and Magnet Forensics to decrypt the message data so it can be extracted and reviewed in the Lexbe eDiscovery Platform.
Discuss the scope of your matter with a digital forensic expert today, commitment-free!
Recovering Deleted Instant Messages
We frequently get questions about the ability to recover deleted messages. Depending on the instant messaging app, duration of time since the deletion, and the state of the device, deleted messages can be recovered. The unallocated space on Smartphones is the area of the flash memory that is no longer tracked by the file system and often contains the targeted deleted files.
Voice Memos, Voice Notes, and Voice Messages via Instant Messaging
Several instant messaging and chat platforms include the capability to send voice messages. These are recorded messages that are usually stored in a designated folder. According to WhatsApp, users send billions of voice messages on their platform each day. Our forensic investigators can quickly identify and collect the voice memos, voice notes, and voice messages that are relevant to your case. Once collected, these recordings can easily be transcribed, indexed, and searchable within the Lexbe eDiscovery Platform.
Instant Message Metadata
Our forensic investigators also collect the metadata associated with each instant message. This includes the original message type such as SMS, MMS, iMessage, or other Messaging App, sender, recipient(s), group(s), date, and time of the message. If photos or other files are included in the instant message, they will also be forensically collected as well as the metadata embedded in those files.
Get a Complimentary Forensic Consult
If you have questions about collecting instant messages and chat files or any other electronically stored information, we’d be happy to schedule a complimentary consult call.
"*" indicates required fields
