When may a forensic examination of a mobile device be required |  Kilpatrick Townsend & Stockton LLP

When may a forensic examination of a mobile device be required | Kilpatrick Townsend & Stockton LLP

As technology advances, emails, especially text messages, can often become a treasure trove of evidence. While email communication requests and hard drive and network fees are standard in modern litigation, parties’ text messages and mobile device fees are often overlooked. A highly specialized forensic petition can be a valuable discovery tool to analyze data on a party’s mobile phone.

Movement Fund for Enforcement

The procedural basis of the movement is based on Federal Rules 34 and 26(b). According to Federal Rule of Civil Procedure 34:

A party may serve any other party with a request under Rule 26(b)

(1) present and permit the requesting party or its agent to inspect, copy, test, or take samples of the following items in the possession, custody or control of the responding party:

(A) any designated documents or information stored in electronic form, including letters, drawings, graphics, diagrams, photographs, sound recordings, pictures and other data or compilations of data, stored in any medium from which the information can be obtained either directly or , if necessary. , after converting the responder to a reasonably convenient form[.]

Federal Civil Procedure Rule 26(b) defines the scope of admissible discovery as follows:

… The parties may obtain information on any non-privileged matter that is relevant to the claim or defense of any party and is proportionate to the needs of the case, considering the importance of the issues raised in the action, the amount in dispute, the relative attitude of the parties access to relevant information, the resources of the parties, the importance of opening to solve problems, and whether the burden or cost of a proposed discovery outweighs its likely benefits….

In determining whether a request for a forensic examination of a party’s telephone should be granted, the court assesses whether the examination “will reveal information relevant to the claims and defenses in the case and whether such an examination is proportionate to the needs.” case, given the mobile phone owner’s overriding interest in the privacy of the contents of his or her mobile phone.” In other words, the otherwise vast amount of discoverable evidence is constrained by a party’s interest in device privacy.[1] Pable v. Chicago Transit Authority, No. 19 CV 7868, 2021 WL 4789023, *2 (ND Ill. April 2, 2021). For this reason, “the requesting party must provide at least some credible information that the opposing party’s statements are misleading or substantially inaccurate.” Identifier.

Pable v. Chicago Transit Authority

AT Tablethe plaintiff, a former employee of the Chicago Transportation Authority (“CTA”), and his supervisor discovered a vulnerability in an application used by the CTA to provide alerts and service information to its public transit users. Identifier. in 1. The vulnerability allegedly could allow unauthorized users to take control of the application and publish unauthorized alerts in the system. Identifier. After the plaintiff’s supervisor attempted to hack into the CTA app to test the plaintiff’s theory, the CTA investigation found that the plaintiff’s actions violated the CTA’s rules, policies, and procedures, forcing the plaintiff to resign instead of being fired. Identifier.

At the time of discovery, the CTA requested all communication from the plaintiff with his supervisor about the allegedly erroneous statement. Identifier. The plaintiff took a picture of his phone and showed, as he claimed, all his messages. Identifier. Having received the plaintiff’s submission, the GTA filed a motion to compel a forensic medical examination of the plaintiff’s phone. Identifier. The CTA was able to cast doubt on the completeness of the plaintiff’s proceedings by demonstrating that the amount of data provided by the plaintiff reflected less than 1% of the phone’s memory capacity and that it contained no messages exchanged between third party applications. Internet browsing and/or search history, sound or visual files, or any data associated with 151 of the 200 applications on the phone. Identifier. at 3.

The plaintiff argued that forcing him to produce a phone for a second image would be an extraordinary remedy, that he had already relayed all messages from his phone, and that the CTA had failed to show that he had opted out of any messages. Identifier. in 1.

The Court granted the CTA’s application for compulsion based on the following: (1) the initial imaging was performed without any possibility for CTA involvement with respect to the protocol undertaken for the imaging process; (2) an extremely small amount of the plaintiff’s products; (3) that the discovery sought—the communication between the plaintiff and his supervisor regarding the allegation—concerned the substance of the plaintiff’s claim; and (4) the plaintiff had no reason to invoke privacy concerns after he himself had already taken the picture of the phone.


Although the many red flags of Plaintiff’s original production set the stage for the CTA’s application for enforcement in this case, the potential value of targeted mobile phone detection by either party should not be discounted. In most cases, we have found that a non-forensic collection of a mobile device is sufficient. However, when doubts creep in about the veracity and completeness of the production of a mobile device, a forensic examination may be required.

[1] See Advisory Notes to Rule 34, “[i]checking or testing certain types of electronically stored information or the respondent’s electronic information system may raise confidentiality or privacy issues.”

Leave a Comment

Your email address will not be published.