The Returned Company Phone and the Missing Text Thread
You are a licensed investigator working for a workers' compensation defense firm in Maine. The employer gives you a company-issued iPhone 12 that an injured employee returned after termination. The employee claims a back injury prevents lifting over 10 pounds and says he cannot work. A public social media post shows him at a gym, but the employer also says the phone contains texts to his spouse such as 'I'll exaggerate my back so the doctor keeps me out.' The phone is in airplane mode, battery at 42%, and locked with a passcode the employer obtained from its mobile device management system. The employer's written policy says company phones are company property and may be monitored, but the employee used the phone for personal texts. The firm wants you to 'scroll through and screenshot the good stuff' and send images by email that afternoon. You have a forensic laptop, a write-blocker, and evidence bags. The hearing is in 30 days.
1. What should you do first with the phone, and what should you avoid?
Read the worked answer
Preserve first. Do not scroll through the original phone. Photograph the phone, record the serial number or IMEI, battery level, time, and who handed it to you. Note that it is in airplane mode and locked. Place it in a Faraday bag or keep it in airplane mode to prevent remote wiping or syncing.
Document authority. Record the passcode source and the employer's written mobile-device policy. Get the employer's written statement that it owns the device and authorized the examination. Have counsel review the personal-text issue before you search.
Avoid: do not open messages on the original, do not screenshot selectively without a forensic image, and do not email images before preserving and hashing the data. Selective screenshots invite challenges that you altered or omitted context. Make a forensic image, verify the hash, and work only on a copy.
2. Describe the chain-of-custody steps from receipt through production.
Read the worked answer
Chain of custody: create a log entry at receipt with date, time, location, from whom, condition, serial number, battery status, and your initials. Seal the original in an evidence bag with tamper-evident tape and sign across the seal. Record every transfer: who had it, when, and why. If you must access it, use a documented forensic process and log the start and end times.
Examination: make a forensic image with a write-blocker, calculate a cryptographic hash, and record the hash in the log. Export the relevant text threads with metadata, including timestamps, participants, and surrounding messages. Do not edit the exports. Keep the original sealed except for necessary forensic access.
Production: provide the forensic image hash, the export method, and a clear index of what was produced. Redact irrelevant personal information only under counsel's direction and document every redaction. The log and hash allow another examiner to verify the evidence.
3. How should the report describe the texts so they can be authenticated at the hearing?
Read the worked answer
Report facts, not conclusions. Identify the device, its owner according to the employer, the forensic method, the hash, and the date and time of extraction. Quote the messages exactly and give context, such as the sender, recipient, and thread. State whether you verified the phone number or account associated with the messages.
Authentication plan: the employer can testify to ownership and the mobile-device policy. A forensic examiner can testify to the imaging and hash. Business records may support the device records. The report should avoid saying 'the employee admitted fraud' unless the message plainly says so; instead, quote the message and let the factfinder interpret it.
Privacy note: because personal texts are involved, the report should state that counsel reviewed the scope and that irrelevant personal content was minimized. That does not guarantee admissibility, but it makes the examination defensible and easier to authenticate.