Picture a departing sales director who returns a company laptop and keeps a personal phone full of customer texts. Mobile device collection is how a legal team gets that phone's data preserved and copied without changing it. Done well, the evidence holds up. Done badly, it can be overwritten, wiped or challenged before anyone reads it.
Phones are hard to leave out of a plan. Pew Research Center's 2026 survey found that 91% of U.S. adults own a smartphone. Work conversations, photos, location history and app data now sit beside personal content on the same device.
This checklist covers when to start mobile device collection, what to do in the first hour, how to scope a collection, how to document custody and which mistakes to avoid. It draws on the National Institute of Standards and Technology's (NIST) Guidelines on Mobile Device Forensics and on Department of Justice guidance for corporate compliance programs.
Key takeaways
- Add a phone to your mobile device collection plan as soon as it may hold relevant data that lives nowhere else.
- Keep the device away from its owner and isolate it from networks, because a remote reset can wipe it.
- Every isolation method has drawbacks, so choose with a trained examiner and write down what you did.
- Scope the collection to the matter. A full image of a personal phone is not always proportional.
- Chain of custody records who held the device, when and why.
When does mobile device collection belong in the plan?
Add a phone when it may hold communications or data that is not stored elsewhere. Common triggers include:
- texts or chat apps used to negotiate deals or direct staff
- a departing employee who used a company phone or a personal phone for work
- allegations of harassment, fraud or data theft
- location data, photos or call logs that bear on the facts
Regulators care about this too. The Department of Justice's Evaluation of Corporate Compliance Programs (updated September 2024) tells prosecutors to review policies on personal devices and messaging apps, and to ask whether business data is "accessible and amenable to preservation by the company." The guidance is written for prosecutors, but its questions are a useful test for any legal team.
What should you do in the first hour with a phone?
Speed matters, and so does restraint. These steps reflect NIST's guidance on securing and isolating mobile devices:
- Take control of the device. NIST cautions that many phones have reset codes that restore factory conditions, and that resets can be triggered remotely. Do not let the owner handle it unsupervised.
- Isolate it from radio networks. NIST lists three options: airplane mode, powering the device off, or a shielded container. Airplane mode may not stop GPS in every case. Powering off can bring back a PIN prompt. A device left on but cut off from networks drains its battery faster, and a shielded bag that is not sealed properly can still connect.
- Record what you see. Photograph the device and the screen, and note the time, service status and battery level.
- Protect the power. NIST warns that battery-powered devices held in storage for more than a day risk power depletion and data loss unless a process prevents it.
- Ask for the passcode in a documented way. NIST suggests requesting security codes when interviewing the owner. Do not guess codes.
- Stop browsing. Opening apps or scrolling through messages changes the device and weakens your record.
Because each choice has trade-offs, bring in a forensic examiner before mobile device collection begins. Our overview of mobile forensics strategy explains what an examiner looks for. The examiner can also advise whether a full forensic image or a targeted extraction fits the case.
Full image or targeted mobile device collection?
Scope should follow the case, in mobile device collection as in any other. Rule 26(b)(1) limits discovery to "any nonprivileged matter that is relevant to any party's claim or defense and proportional to the needs of the case." For a phone, that usually means asking four questions:
- Which custodian and which device?
- Which date range?
- Which apps or data types, such as messages, call logs, photos or location?
- What personal content should be filtered out or never reviewed?
Personal phones add privacy questions. A written BYOD policy and the owner's documented consent make mobile device collection smoother, and a narrow scope makes it easier to defend. Privacy rules vary by state and country, so counsel should set the terms and the examiner should carry them out.
How do you document chain of custody for a phone?
NIST defines chain of custody as a process that tracks the movement of evidence through its collection, safeguarding and analysis by documenting each person who handled it, the date and time it was collected or transferred, and the purpose of any transfer.
In practice, keep a log with the device's make, model and identifiers, its condition, who received it and every handoff. NIST also describes forensic hash validation: a hash computed over the acquired data lets you detect any later change. Together, the log and the hash let you show that the copy matches the source.
What about computers, cloud backups and linked accounts?
The phone is rarely the only source. NIST notes that equipment associated with a mobile device, such as removable media or personal computers, may prove more valuable than the device itself. A computer that syncs with a phone can hold data the phone does not. Cloud backups and linked accounts add further sources, each of which may need its own authority or consent.
List these sources in the collection plan at the start. Finding them later usually means asking for access a second time.
Which mistakes put mobile evidence at risk?
- Waiting while the owner trades in or upgrades the phone.
- Letting a well-meaning colleague "back it up and reset it."
- Leaving auto-delete settings on after a matter is anticipated.
- Scrolling through the phone by hand and taking screenshots as the only record.
- Skipping the custody log.
- Collecting everything without a defined scope.
How Gemean helps with mobile forensics
Gemean's Digital Forensics and Cyber Security practice includes mobile forensics, and the firm supports legal teams that need digital evidence from devices preserved and examined in a way that can be explained later. If a phone is part of a live matter, reach out to our team before anyone touches it.
FAQs
What is mobile device collection?
Mobile device collection is the process of preserving and copying data from a phone or tablet so that its contents stay intact and can be explained in a legal or investigative matter.
Is airplane mode enough to preserve a phone?
Not by itself. NIST describes airplane mode as one of three isolation methods, each with drawbacks, and notes it may not stop services such as GPS in every case. A trained examiner can pick the safest approach for the device.
Can deleted texts be recovered?
Sometimes. It depends on the device, the app, the operating system and how quickly the phone is preserved. No one can promise recovery before an examiner has looked.
Should we image an employee's personal phone in full?
Not automatically. Scope should be proportional to the matter, and personal content raises privacy concerns. Many collections target specific apps, dates and data types, with the reasons recorded.
Can IT collect the phone instead of a forensic examiner?
IT tools are built for support rather than evidence handling, so they may change data or fall short on documentation. For a matter that may be contested, a forensic examiner is the safer choice.
Sources
- Guidelines on Mobile Device Forensics, NIST Special Publication 800-101 Revision 1, Ayers, Brothers and Jansen (NIST, May 2014): https://csrc.nist.gov/pubs/sp/800/101/r1/final
- Guidelines on Mobile Device Forensics, full text PDF (NIST, May 2014): https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-101r1.pdf
- Evaluation of Corporate Compliance Programs, updated September 2024 (U.S. Department of Justice, Criminal Division): https://www.justice.gov/criminal/criminal-fraud/page/file/937501/dl
- Mobile Fact Sheet, 91% of U.S. adults own a smartphone (Pew Research Center, 2026 survey): https://www.pewresearch.org/internet/fact-sheet/mobile/
- Federal Rules of Civil Procedure, Rule 26 (Legal Information Institute, Cornell Law School): https://www.law.cornell.edu/rules/frcp/rule_26
- Gemean Digital Forensics and Cyber Security (Gemean): https://gemean.com/cybersecurity/
