- Community hunger for knowledge surrounding mobile data and discovery is as strong as ever.
- Ephemeral and quasi-ephemeral data presents many implications for collection and information governance.
- Relativity’s Short Message Format may be the first step towards a standard for mobile data discovery.
- Relativity’s interface API enhancements will greatly simplify custom viewer solutions for developers.
For the past few years, there has been a lot of buzz around the proliferation of e-discovery projects with a significant mobile data component. It is undeniable that considerable business is being conducted via text message and other unique data pulled from mobile devices, yet there is still no standard for performing mobile data discovery within Relativity.
Relativity Fest 2019 offered a number of sessions that addressed the community’s hunger for information and solutions regarding mobile data and other non-traditional ESI. All were well attended and feedback from the audience ranged from curious (what is the best way to vet the tools on the market?) to fervent (why is there still no simple solution for conversation threading – outside of a number of vendors who have been building their own custom solutions for years?)
The panel entitled, Don’t Treat Your Apples Like Oranges: A Fruitful FAQ for The Unique Challenges of iPhone Forensics delivered a wealth of information and insights from both the forensics and eDiscovery attorney perspectives.
From the forensics side, it was reported that requests for images and location data are becoming more common, a shift from the typical requests limited to just text/chat messages. Other potentially pertinent information that often gets overlooked is user search history and a list of applications installed on the device. A portion of this particular panel was also dedicated to one of the more common questions we often hear: can deleted text messages be recovered? The short answer is a cautionary yes, it’s possible, though not all of the standard data (time, sender info, even the text of the message itself) is guaranteed to be available and recovery of these messages ranges from easy (identified by the forensics tool), to difficult (manually parsing the hexadecimal message strings).
The panel on ephemeral and quasi-ephemeral data gave context to the growing importance of non-traditional communications in e-discovery.
With the increased use of 3rd party and non-standardized chat/messaging platforms, successful collection and preservation of this data can become very difficult. There are a number of chat programs that boast end-to-end encryption preventing any standard collection methods, and require impractical work-arounds like photos/screenshots of the original sender or recipient’s screen (one key to defensibility: document the timestamp of the photos and have their author available to testify). The opinions of attorneys on both real and highly-probable cases shed light on the validity of demands for this data, and the implications and considerations for strengthening information governance practices.
For example, there are cases where a party may have a legitimate justification for the use of quasi-ephemeral messaging programs, such as securing conversations involving state/trade secrets, or other unique features of the programs, such as Slack’s widely compatible API. At the same time, companies must be weary of potential nefarious uses, including obscuring criminal activities.
For standard mobile text communications, Cellebrite (developer of mobile forensics tools UFED and Physical Analyzer) had a strong showing, displaying their new Relativity integration, Legalview.
Legalview and its implementations can be likened to Special Counsel’s Discover Mobile discovery solution, except that it leverages Relativity’s new RSMV (Relativity Short Message Viewer) by exporting its associated file format (RSMF) directly from Physical Analyzer. Widespread adoption of the Short Message Viewer and Format could have great implications for mobile discovery industry-wide, though it is not without its shortcomings. One presentation on Short Message Format detailed three ongoing issues:
- Deduplication across devices. This is difficult due to a lack of fields with which to create a hash value acceptable for deduplication.
- Conversation Threading.
- Advanced Analytics. Messages are often too limited in terms volume of text and context.
Vendors that can tackle these issues with innovative solutions will likely gain the competitive edge as mobile discovery becomes more prevalent.
Finally, for innovators that decide to continue developing their own proprietary solutions for processing, reviewing, and producing non-traditional ESI, there is promise in Relativity’s new Relativity Review API enhancements.
With some improvements–including highlights and redactions–already available now, and significant changes coming in the following release, developers will be able to make modifications to the Relativity Viewer with ease. Relativity provided a live demo of these enhancements, which included a walkthrough of an example customization. Additionally, they displayed forthcoming enhancements that will allow targeting of specific elements (window panes, frames, etc.) of the viewer. Now, instead of trial-and-error hacking to get custom buttons and functions implemented, each section of the viewer will be treated as a separate pane that can be referenced in the developer’s code.