Client Received Production Text Messages as PDFs – Client Wanted to Know About Actual Texts

CHALLENGE

Our client wished to retrieve alleged harassing text messages from an ex-employee’s iPhone. Certain text messages had been produced as screenshot PDFs, but did not appear to be actual threads exchanged between two or more parties.

Our client needed to obtain a forensic image of an ex-employee’s iPhone to determine:

What (if any) text messages had been exchanged between the ex-employee and a former supervisor
Whether replies to certain text messages existed
Whether the produced text messages could be authenticated as being sent/received from the specific iPhone

Solution

Through an agreed upon forensics protocol, our Forensics Team was able to create a forensic image of the ex-employee’s iPhone.

The iDS Forensics Team performed analysis and reported on the following:

The location of purported text messages and the deletion of same
That the authentic text messages, to the extent they existed, had been selectively screenshotted, saved to the phone’s camera roll, and then complete text message exchanges purged
That the iPhone was set to retain messages forever, and therefore the text messages did not “auto” delete themselves

Result

iDS was able to identify that the text messages in question were hand selected for production and were incomplete.

Our client was able to leverage our findings to demonstrate that actual text messages had been purged post-filing of litigation and that they were incomplete. As a result, our client used the findings to achiever a favorable outcome.