Preserving a Device Before It Changes
Every minute a phone stays in service, it deletes cached data, rotates logs and expires messages. Preservation is not an evidential nicety in that environment; it is the difference between having the material and reconstructing an argument about what it might have contained.
The rule in short
Preserving a device means isolating it from networks and from further use, capturing an image of its contents by a method that does not alter them, and documenting who did what and when. Where a full forensic image is impractical, an account export, a structured application export and a systematic photographic record together form a defensible substitute, provided the reason for the constraint is recorded.
A phone is not a filing cabinet that waits patiently. It is a running system that expires messages, rotates logs and synchronizes with servers continuously, and every hour it stays in ordinary use is an hour of material quietly disappearing.
Why speed matters more here than anywhere
Automatic deletion continues. Disappearing-message timers, cache expiry and log rotation all run on schedules set long before, and none of them knows that a dispute has arisen, as messages that delete themselves describes.
Ordinary use overwrites. Deleted data survives in unallocated space only until something else is written over it, and every photograph taken, message received and application installed reduces what can still be recovered.
Synchronization propagates deletions. Material removed on another device signed into the same account disappears here too, so a phone left connected is not a preserved phone.
Remote wipe is available to the owner. Anybody with the account credentials can erase a device from anywhere, and a phone left online can be emptied in seconds.
Updates change the system. An operating system update rewrites large parts of the storage and can render previously recoverable material permanently inaccessible.
Which makes hours matter. The gap between a dispute becoming foreseeable and a device being secured is where the great majority of digital evidence is actually lost.
Isolating the device
Disconnect it from networks. Aircraft mode is the practical first step, and turning off wireless and cellular separately is more reliable again. Both prevent synchronization and remote instructions from reaching the device.
Do not power it off casually. Restarting a device can trigger encryption states that make later access harder, so a device already unlocked is generally kept in that condition.
Keep it charged. A device that runs flat may require credentials on restart that nobody has, which converts an accessible phone into an inaccessible one.
Preserve the passcode. Recorded separately and immediately, because a passcode that nobody wrote down is by some distance the commonest reason a carefully preserved device yields nothing at all.
Stop using it. Which sounds obvious and is routinely ignored in practice, because the owner needs their phone for ordinary life and takes it back for a few days while arrangements are being made.
| Method | Captures deleted data | Requires a specialist |
|---|---|---|
| Forensic image | Yes | Yes |
| Logical extraction | Limited | Usually |
| Account export | Provider-held only | No |
| Application export | No | No |
| Photographing the screen | No | No |
Capturing the contents
A forensic image is the strongest option. A bit-level copy taken by a method that does not write anything back to the device, capturing deleted fragments and system artefacts that no ordinary export includes.
Logical extraction is the common compromise. A structured export of messages, media and application data, which is quicker and considerably cheaper, and which captures live material while leaving deleted remnants behind.
An account export supplements both. Because much of the material is on a provider's servers rather than the handset, as cloud accounts and where the data sits sets out.
Photograph the device itself. Its condition, its serial identifiers and the state of the screen, because those photographs become the evidence that the item later examined is the item that was originally taken.
Hash the image. A cryptographic checksum computed at the moment of capture and recorded alongside it, which allows anybody afterward to demonstrate that the copy examined is unchanged since it was taken.
The single most common reason a carefully preserved device produces nothing is that the passcode was never recorded. It takes ten seconds, it should happen before anything else, and it should be stored separately from the device.
Documenting the handling
Who, when and what. Every person who handled the device, when they received it, what they did with it and when they passed it on, recorded contemporaneously rather than assembled afterward.
Contemporaneous notes, not reconstruction. A handling record written afterward from memory is worth a fraction of one written at the time, for the reasons set out in recollection and reconstruction.
Record what could not be done. A device that could not be unlocked, or an account that could not be reached, should be recorded as such with the reason and the date.
Store it securely. A preserved device left in a drawer that several people can open has a custody record with a hole in it, whatever the paperwork says about who was responsible for it.
Keep the record with the image. Because the handling record and the extracted data together form one piece of evidence, and a dataset with no provenance attached to it is a dataset that anybody can question.
When imaging is impractical
Account exports first. They are free, fast and comprehensive for provider-held material, and they require no equipment, no specialist and no cooperation beyond that of the account holder.
Structured application exports second. Many messaging applications will export a conversation in full with its attachments, which preserves the sequence and the surrounding context that screenshots destroy entirely.
Photograph systematically. Where nothing else at all is available, a complete photographic record of a conversation, taken in order and without gaps, is far better than a handful of individually selected images.
Explain the constraint. A short statement setting out why a full image was not taken, what was done instead and who decided, converts an apparent gap into a documented and defensible decision.
Preserve the device anyway. Even where nothing can be extracted at present, keeping the handset unused and charged preserves the possibility of extraction later, when tooling or circumstances have changed.
Preservation in this area is a race rather than a procedure. Everything else discussed in evidence practice can be done next month; a phone left in ordinary use for a month has lost material that no amount of later effort recovers.
Isolation comes first because it stops both of the fast destroyers at once: synchronization from another device, and a remote wipe that anybody with the account credentials can trigger from anywhere in a few seconds.
The imaging decision is a proportionality question rather than a technical one. A full forensic image is the strongest option and is expensive; account exports and structured application exports cost nothing and cover most of what matters in most cases.
Documentation is what turns preserved data into usable evidence. A dataset whose handling can be described from contemporaneous notes withstands examination, and one that appeared from somewhere without explanation invites questions nobody can answer.
Where constraints prevent doing this properly, saying so plainly and recording what was done instead is far stronger than presenting an incomplete capture as though it were a complete one. Where the handset has already gone, the position is different and is described in when a Device Is Lost or Wiped.
Points to carry away
- A device in use overwrites material continuously and irreversibly.
- Isolation from networks prevents remote deletion and synchronization.
- A forensic image captures far more than any export.
- The record of who handled the device is part of the evidence.
- Where imaging is impractical, an account export is the fallback.
Questions readers ask
Should a phone be switched off to preserve it?
Generally not, if it is already unlocked and accessible. Powering a device down can move it into a state where a passcode or biometric is required to decrypt storage, and where the credentials are unavailable that converts an accessible device into an inaccessible one. The usual approach is to disconnect it from networks, keep it powered and charged, and stop using it, which prevents synchronization and remote wiping without changing its encryption state.
Is a forensic image always necessary?
No, and treating it as mandatory produces unnecessary cost in ordinary matters. A full image earns its place where deleted material matters, where the device's own artefacts are in issue, or where the material is likely to be seriously contested. For a great many disputes an account export and a structured application export capture everything that will actually be relied on, cost nothing, and can be obtained within days. The decision is one of proportion rather than principle.
What happens if the device was used for weeks before anybody preserved it?
Some material will have gone permanently, and a good deal usually remains. Provider-held data is unaffected by use of the handset, disappearing-message timers only reach the conversations they were enabled on, and backups taken during the period may capture an earlier state. What is lost is deleted material in unallocated space, which continued use overwrites. The practical response is to preserve immediately regardless, and to record honestly when preservation began and why it was not earlier.
Sources
- Federal Rules of Civil Procedure — Rule 37, Failure to Make Disclosureslaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 34, Producing Documents and Electronically Stored Informationlaw.cornell.edu
- Federal Rules of Civil Procedure — Rule 26, Duty to Discloselaw.cornell.edu
- Federal Rules of Evidence — Rule 901, Authenticating or Identifying Evidencelaw.cornell.edu
- National Institute of Standards and Technology — Publicationsnist.gov
- 18 U.S. Code § 2701 — Unlawful Access to Stored Communicationslaw.cornell.edu
True Justice Record is a publication, not a law firm. This article states general rules and cites its sources; it is not advice about any particular case, and the law differs by state and changes over time.
More in Evidence That Lives on a Phone
When a Device Is Lost or Wiped
Where a device is gone, provider-held account data is unaffected, backups may capture an earlier state, and the other participants in any conversation hold their own copies. The circumstances of the loss then matter separately: an ordinary loss is neutral, while a wipe performed after a duty to preserve arose is treated as spoliation.
Voice Notes and Recordings
A recording is authenticated by evidence of how it was made and by whom, identification of the voices on it, and confirmation that it is complete and unaltered. Transcripts are aids rather than evidence. Editing is easy and increasingly hard to detect, so provenance carries more weight than any examination of the audio itself.
Location History Offered as Evidence
Location evidence comes from satellite positioning, from network cell sites, from wireless network observations and from application check-ins, each with a different accuracy. All of it places a device rather than a person. Interpreting it responsibly means establishing which method produced each point and what margin that method carries.