Your Client’s Data Moved. Did the Evidence?

---

Replacing a smartphone has become remarkably easy.  A user buys a new device, signs into an account, follows a few prompts, and before long the new phone looks like the old one.  To them, it may seem as though the old phone has simply been recreated on new hardware.  From a digital forensic perspective, that is not necessarily what happened.

A replacement phone may contain much of the information a user recognizes while still lacking forensic artifacts that existed on the original device.  When a phone is replaced, some information may be restored from a backup, while other information synchronizes from a cloud account.  Applications may be downloaded again and retrieve data from their own servers.  A user may find years of photographs, text messages, contacts, and notes, so the result can look complete.  It may not be.

A forensic examination can involve more information than what is visible to the common user.  Application databases, system records, cached files, and device-specific artifacts exist behind the scenes.

Where Does Data Actually Live?

Smartphone data may exist on the device, in a cloud account, within an application’s servers, in a backup, or on another connected device.  An application may display years of activity even though some information was downloaded after the replacement phone was activated.

The presence of information on a replacement phone does not always mean it was physically stored there at the time of the event.  Forensic interpretation requires understanding what information is present and how it got there.

What Can Be Lost?

There is no universal list of information that will or will not survive a phone migration.  The answer depends on the device, operating system, applications, and backup settings.

Some evidence may be particularly dependent on the original device, such as data contained in local databases, cached content, logs, or other artifacts not included in cloud synchronization.  Deleted information available on the original device may not be present on the replacement.

Even when the same content appears on both phones, its forensic context may change.  A photograph taken months earlier may appear on a new phone after synchronization. It may retain metadata showing when it was created, while other records reflect when it arrived on the replacement device.

The Trade-In Problem

The greatest challenge often occurs before anyone thinks to involve a forensic examiner.  An incident happens, a claim is filed, and somewhere along the way, a person replaces their phone because of damage, a failing battery, a routine upgrade, etc.  The old phone is then factory reset, traded in, recycled, returned to an employer, or becomes otherwise unavailable.  Then, months later, someone asks whether it can be examined.

The replacement device may still contain significant evidence and relevant information may exist in backups, cloud accounts, or other devices.  But, the opportunity to examine the original phone may be gone.

Preserve First, Replace Second

One simple question to ask early in a case is also one of the most important: Is the phone that was in use at the time of the incident still available?

If so, consideration should be given to preserving the phone before it is replaced, reset, or altered.  While not every phone requires it, an immediate and thorough forensic examination is recommended, because some data types are not preserved indefinitely. 

For example, the application usage logs that can be important when determining if distracted driving was involved in a crash are typically overwritten after 30 days, depending on the type of device.  Preserving the data itself is more valuable than preserving the physical device.  The appropriate response depends on the type of device and the type of data involved.

A replacement phone may still contain relevant messages, photographs, application data, and account information, but recognizing that it is not necessarily a forensic duplicate of the phone it replaced is key. Smartphone migration is designed to make a new device feel like the old one.  For forensic purposes, however, familiarity and equivalence are not the same thing.  A new phone can reproduce much of a person’s digital life without reproducing the complete forensic history.

The best time to ask about the old phone is while it is still the current phone.