Digital & Computer Forensics
Computer, Mobile & Digital Forensics News
Oct 20, 2015 at 05:55pm
Regardless of the nature of the litigation you are involved in, it is common that relevant information isl likely to be on a cellphone of a party on the other side of the litigation. And it may be the only place the data is stored. Depending on the service provider, the period for which the data may be available through them varies greatly. Below is a brief overview *:
* Keep in mind policies change from time to time.
As indicated above, two categories commonly important to litigation, text message content and pictures, are typically not retained by service providers. They can, however, be obtained via a forensic imaging of their phone, unless the phone has been lost, destroyed, traded in or wiped (which could put the user in more trouble).
Even deleted items may be recovered, depending upon the make of device and how long the deletion activity took place. Backups of phone data may also exist on an individual's computer that can date back for an extended period of time, which can also be forensically acquired.
Other potentially relevant information that can be obtained from the device via forensic imaging includes GPS information and internet history. Web-based email can also be recovered directly from the internet without the need to obtain the phone, so keep thinking "outside the box"!
Retention Periods for Cellular Service Providers
Major Cellular Service Provider
Retention Periods
Regardless of the nature of the litigation you are involved in, it is common that relevant information isl likely to be on a cellphone of a party on the other side of the litigation. And it may be the only place the data is stored. Depending on the service provider, the period for which the data may be available through them varies greatly. Below is a brief overview *:
Verizon | Sprint | T-Mobile | AT&T/Cing | Nextel | Virgin | |
Subscriber Information | 3-5 years | Unlimited | 5 years | Depends on Service Period | Unlimited | Unlimited |
Call Detail | 1 Year | 18-24 months | 5 years | 5-7 years | 18-24 months | 2 years |
Text Detail | 1 year | 18 months | 5 years | 5-7 years | 18 months | 60-90 days |
Text Content | 3-5 days | Not retained | Not retained | Not retained | Not retained | 90 days |
Pictures | Only if uploaded to site (customer can delete) | Contact provider | Only if uploaded (customer can delete) or until service is cancelled | Not retained | Contract provider | Not retained |
IP Session Information | 1 year | 60 days | Not retained | Only non-public IP's for 72 hours | 60 days | Not retained |
Bill Copies | 3-5 years | 7 years | Not retained | 5-7 years | 7 years | Not retained |
As indicated above, two categories commonly important to litigation, text message content and pictures, are typically not retained by service providers. They can, however, be obtained via a forensic imaging of their phone, unless the phone has been lost, destroyed, traded in or wiped (which could put the user in more trouble).
Even deleted items may be recovered, depending upon the make of device and how long the deletion activity took place. Backups of phone data may also exist on an individual's computer that can date back for an extended period of time, which can also be forensically acquired.
Other potentially relevant information that can be obtained from the device via forensic imaging includes GPS information and internet history. Web-based email can also be recovered directly from the internet without the need to obtain the phone, so keep thinking "outside the box"!