Do we still have the messages?

A recent Delaware case involving the WWE merger is a pretty good reminder. Senior executives were communicating through Signal. After preservation obligations had arisen, disappearing-message settings were used and, in some instances, changed so messages would disappear within hours.

The Delaware Court of Chancery found that evidence had been destroyed and imposed sanctions. Among which the court shifted some of the uncertainty created by the missing messages BACK onto the people who allowed them to disappear.

We still see versions of this all the time.

A dispute is brewing. Everyone knows the phones probably contain relevant texts, Signal messages, WhatsApps, photos, deleted files, location information or other evidence. And then everyone talks about it for three weeks before somebody actually preserves the devices.

Sometimes that works out. And sometimes evidence keeps disappearing while the lawyers are deciding what to do.

And forensic examiners cannot wave a magic wand and recreate everything that once existed on a phone. Encryption, app design, deletion settings, backups and the passage of time all matter.

So when litigation is reasonably foreseeable and a phone may contain important evidence, one of the simplest pieces of advice I can give is:
Preserve first. Figure out what you want to examine second.

Preservation does not mean you have to search everything. It means you haven’t unnecessarily lost the option. That can be a very important distinction six months later when somebody asks:

“Do we still have the messages?”