Text messages are a significant part of communication in today's world and one absolutely not to overlook as part of the eDiscovery process. In this two-part blog, we'll discuss the different methods used to show text message conversations in eDiscovery review, whether they are forensically sound, and how to create an accurate visual display to show text message conversations.
Part 1 of this post series discussed how email and text messages are similar yet different and the implications for processing and reviewing this data (to read the previous post, click here).
In part two of this series, we'll cover the distinct details related to the review and presentation of text messages. Beginning with…
It may seem that screenshots would work to resolve this problem, but unfortunately, not so. A screenshot is quite easy to alter, either by creating fake text messages on a device, sending fake text messages to a device, and other alterations that a viewer may not easily detect. This is why cell phone extractions using forensic methods are the most appropriate way to gather messaging evidence.
Once individual messages are forensically extracted, what is the best approach to display them in a way that is easy to review? The most accurate and forensically sound manner is to label an individual message as evidence and then create a demonstrative of those messages in a conversation view. This way, conversations can be normalized in a common format across multiple extractions from multiple devices. But – and this is critical – the underlying forensic data has been preserved.
The most common complaint of viewing individual text messages is the lack of context. Not knowing what messages came before and after can make it difficult to figure out what is happening. By contrast, in email, you can scroll down to read the previous pieces of communication. An email thread usually contains a few dozen replies; a text message chain, however, can include hundreds of messages. This presents an additional complication with searching, as a search term could hit somewhere within those hundreds of messages and be problematic to locate.
One possible solution is to load the text messages into an eDiscovery tool as separate documents with individual numbering. Then, download the documents to Excel for review with their dates, times, individual numbering, and associated metadata.
When on the stand, a witness presents a screenshot of a text message as it appears on the witness's phone. The witness testifies that what is displayed is part of a conversation with the other party in the lawsuit. Upon cross-examination, the witness is presented with a screenshot of the other party's view of that conversation. Not only does it appear differently, but the substance of the conversation and the dates and times are slightly different. Who is telling the truth? Who has the correct evidence? Does either of these demonstratives have any forensic foundation? This is why the forensic method needs to lead to the demonstrative rather than using easy-to-create but potentially inaccurate screenshots.
In summary, using forensic extraction methods is imperative to get data from a phone and then properly process that data to create conversations. Then, export that information for review in the format that is easiest for the reviewer based on the technology they have. Ensure you produce the data with all relevant metadata useful for further review and to incorporate during proceedings.
The lack of standard underlying data is the legal industry's obstacle for reviewing, producing, and using text messages in legal proceedings. Data is stored on a device in individual messages, not bubbles, and forensic extraction provides the messages rather than conversations. Unfortunately, the best method is not the one that provides the easiest visual review. The solution is to begin with the individual messages and then piece them together in a conversation format for a reliable visual display.