Almost every dispute now has a phone in it, and almost every phone is handled badly. A screenshot can be produced by anybody with a text editor, and the metadata that would make it worth something is stripped by the act of screenshotting. Messages delete themselves on a schedule nobody set deliberately, and a cloud account holds a copy in a jurisdiction the owner has never thought about. This subject sets out what a device holds, how it is preserved before it changes, and which parts of it a decision-maker will accept.
Preserving a device means isolating it from networks and from further use, capturing an image of its contents by a method that does not alter them, and documenting who did what and when. Where a full forensic image is impractical, an account export, a structured application export and a systematic photographic record together form a defensible substitute, provided the reason for the constraint is recorded.
