Post By: David Carns
Many companies lack formal adequate tools to conduct internal investigations, in part because there is so much to consider. Processes and technology are needed for preservation, collection, processing, and review of data related to internal investigations and it is complicated to know where to begin. But a little bit of upfront effort will improve the outcomes for investigations as they arise, and help you adjust to where the facts will lead, how project scope may change, or what legal and logistical complications may arise.
With the emergence of COVID-19 and work-from-home mandates, investigations have become even more difficult to manage in part because more information can potentially be stored on a variety of mobile devices. As a result, mobile device management (MDM) software and utilities are increasingly important in the identification and collection of data for an internal investigation.
MDM software helps enterprises securely manage and monitor the use of smartphones, tablets, and laptops by employees. MDM can ensure that equipment is configured and updated in a consistent, standardized, and scalable way and that enterprise systems are only accessible by devices managed by the MDM software. It also makes remote diagnosis and troubleshooting of problems more efficient. Not only is MDM is necessary for employees to access corporate email on a device, it also gives companies the capacity to remotely “wipe” email from devices.
In investigations, MDM is a useful tool for investigation since it allows IT personnel to track exactly how employees are accessing company data, files, and email, effectively unifying siloed information into a single, trackable system. MDM can also provide investigators with valuable about where, when, and from which devices corporate data is being accessed. It is a very precise tool for documenting when and how employees are using mobile devices from different locations to access a company’s information system.
It is worthy to note that MDM software is not a forensic collection tool, but rather a device identification and management tool. Once a device has been identified as being a potential target of an investigation, then an organization will need to use a forensic tool to acquire data from the mobile device. Software such as Cellebrite is often used for mobile device data acquisition. The catch is that Cellebrite’s output is very difficult for most non-technical people to analyze, but the data captured is comprehensive and accurate.
There are, however, some eDiscovery tools that can convert MDM data extracted with Cellebrite into a much more user-friendly format. These tools organize the information sequentially and reveal chat-like conversations resembling person-to-person communications as they might appear on a phone. As mobile data increases in importance in investigations, organizations that wish to be more proactive in their compliance and investigative practices should make sure they have a good tool for converting Cellebrite-generated call, chat, social media and similar mobile data into a usable format. This is especially important when you consider the cost of labor when investigators and legal professionals have to decipher the data and determine what story it tells.
As more corporate employees do more work from remote locations, including their homes, compliance professionals need to be aware of the increasing relevance of MDM data to investigations. Principles like confidentiality, professionalism, independence, and consistent processes are a crucial part of planning for future investigations, but they should not be the sole focus of planning. Compliance and risk professionals would also do well to keep current on the details of their organization’s technology infrastructure, and identify and procure cost-effective, purpose-built technologies for discovery before the next “minor” investigation blows up into something more substantial. Most corporations use hundreds of applications across the organization, and MDM is just one example of many data types that require appropriate tools for conversion into a format that enables investigators to quickly grasp the facts.
About the Author: David Carns is chief revenue officer at Casepoint. An attorney with more than 20 years of technology consulting and management experience, David has specialized in eDiscovery technology since 2007. He received his J.D. from The John Marshall Law School and has served as an adjunct professor of legal technology at Georgetown University.