The Perils of Delayed Mobile Device Preservation
At SJDC, we consistently emphasize the importance of prompt preservation of mobile device data for litigation. While some matters may not demand immediate action, others—such as significant event investigations (e.g., traffic crashes, death investigations, or workplace accidents) or intellectual property theft cases—can face devastating consequences if critical data is not preserved right away. The most valuable data in these cases—often the type that provides the clearest answers—has a short shelf life and is easily overwritten through regular device usage.
Failure to act quickly—especially upon receipt of a preservation request—can result in data spoliation, opening the door for opposing counsel to pursue sanctions, including an adverse inference ruling. Attorneys who issue well-drafted preservation orders do so with the clear expectation that the relevant evidence will be promptly and properly preserved. When that expectation isn’t met and data is lost, courts may assume the missing evidence was unfavorable—sometimes shifting the entire direction of a case. Prompt, proper preservation isn’t just a best practice; it’s a critical legal safeguard.
Let’s explore the types of critical data that can be permanently lost without timely preservation, the risks associated with delays, and the best strategies for handling these situations.
Short-Lived Data: Why Time is of the Essence
Modern smartphones track an extensive range of device activity, including:
- App usage (e.g, app foreground/background logs, app executions, deleted apps)
- User interactions (e.g., device being plugged or unplugged, locked or unlocked, orientation changes)
- Connection logs (e.g., CarPlay/Android Auto usage, Bluetooth activity, Wi-Fi connections)
- System metrics (e.g., power logs, Siri usage, Focus modes like Driving or Gaming, screen/backlight activations, and audio routing)
- Location data (e.g., highly detailed and dense records of device movements for the last 7-10 days)
This highly detailed and time-sensitive data can paint a vivid picture of what was happening on or with the device at any given moment. However, much of this data is transient—it is routinely overwritten or erased within days or (at most – with very light usage) a few weeks. If not preserved in time, this critical information will be permanently lost, significantly impacting the outcome of an investigation or legal case.
The Risk of Delayed Action
We are frequently retained by attorneys who may not have extensive experience handling these types of cases. Despite our strong recommendations to immediately preserve mobile device data, delays often occur—sometimes due to logistical challenges, costs, and skepticism on the part of clients and/or device custodians. Unfortunately, when critical data becomes unrecoverable, the reality of the situation hits hard.
From our experience, the conversations attorneys should have with companies or device owners may seem unnecessary or overzealous. However, the far more difficult conversation is the one an attorney must have with their client after an adverse inference ruling—when the court assumes missing evidence would have been unfavorable to their case. And, both plaintiff and defense attorneys who serve well-crafted preservation orders understand the risks and likely outcomes when companies and/or device owners fail to take appropriate action.
What to Do If Prompt Forensic Preservation Isn’t Immediately Feasible
If a forensic extraction cannot be arranged right away, we almost always recommend the following steps:
- Enable Airplane Mode – This prevents further network activity or remote access.
- Disable Bluetooth and Wi-Fi – While Airplane Mode should disable them, manually turning them off adds an extra layer of protection.
- Disable Stolen Device Protection – this is fairly new (as of this writing) iOS setting that must be disabled to allow the forensic extraction (if the case requires it).
- Power Off the Device – This halts system processes that may overwrite critical data.
- Securely Store the Device – Keep it in a safe location until a forensic professional can properly preserve it.
While this approach requires the device owner to either temporarily go without their phone or obtain a replacement, it pales in comparison to the legal and financial repercussions of data loss due to failure to properly preserve—especially when facing an adverse inference ruling. While these steps can help, some evidence may still be lost without a proper forensic extraction. It’s essential to first confirm that immediate preservation truly isn’t an option—and be prepared to justify this approach if challenged.
If You Receive a Mobile Device Preservation Order, What’s Next?
The first step should always be to consult a digital forensic professional experienced in handling these types of cases. A knowledgeable expert can explain the forensic preservation process, outline available options, and set realistic expectations—before any commitment is made to a full forensic extraction and analysis.
We often advise clients to follow the outlined preservation steps and securely store the device until the case reaches a stage where a formal forensic collection is necessary. However, each case is unique, and consulting a professional before taking any action is crucial, as specific circumstances may call for a different approach.
Choosing the Right Digital Forensic Professional Matters
Selecting the wrong forensic expert can be just as damaging as failing to preserve the device properly. Some professionals may recommend cheaper but inadequate extraction methods, which can result in incomplete data recovery or even data loss—leading to the same legal consequences as failing to preserve the device in the first place.
Before making a digital forensic service provider decision, ask detailed questions about forensic preservation methods and don’t hesitate to consult multiple providers. Ensuring you receive the right information upfront can save time, money, and, most importantly, the integrity of your case.
EDIT (March 24, 2025)
Right after posting this, I came across a very good article that provides additional detail about the types of mobile artifacts that can disappear without prompt preservation—sometimes within just a few days. Highly recommended reading:
Disappearing Evidence: Why Your Phone Can’t Wait for Forensics