Almost every dispute now has a phone in it, and almost every phone is handled badly. A screenshot can be produced by anybody with a text editor, and the metadata that would make it worth something is stripped by the act of screenshotting. Messages delete themselves on a schedule nobody set deliberately, and a cloud account holds a copy in a jurisdiction the owner has never thought about. This subject sets out what a device holds, how it is preserved before it changes, and which parts of it a decision-maker will accept.
Where a device is gone, provider-held account data is unaffected, backups may capture an earlier state, and the other participants in any conversation hold their own copies. The circumstances of the loss then matter separately: an ordinary loss is neutral, while a wipe performed after a duty to preserve arose is treated as spoliation.
A recording is authenticated by evidence of how it was made and by whom, identification of the voices on it, and confirmation that it is complete and unaltered. Transcripts are aids rather than evidence. Editing is easy and increasingly hard to detect, so provenance carries more weight than any examination of the audio itself.
Location evidence comes from satellite positioning, from network cell sites, from wireless network observations and from application check-ins, each with a different accuracy. All of it places a device rather than a person. Interpreting it responsibly means establishing which method produced each point and what margin that method carries.
Social media evidence presents two distinct problems. The first is capture: a post can be edited or removed at any time, so a record has to be made that will outlive it. The second is attribution: an account is not a person, and connecting a post to an individual requires evidence beyond the display name on the profile.
Carrier records establish that a call or message occurred, when, for how long, between which numbers and from roughly where. They almost never contain content, which is generally not retained at all. That limitation matters less than it appears, because pattern, timing and frequency answer many questions that a transcript would not.
A phone holds locally stored data, synchronized copies of account data held by service providers, and metadata generated by carriers. Each is reached by a different route: the device by consent or a forensic order, provider accounts by the account holder or by process served on the provider, and carrier records by process with notice.
Provider-held account data is reached through the account holder or through process served on the provider. Statutory schemes distinguish sharply between the content of communications and the records about them, with content protected more heavily. Location of the servers matters less than it once did, and the identity of the corporate entity served matters a great deal.
Disappearing-message settings remove content from devices and frequently from provider servers on a timer. Fragments survive in backups, in notifications, in the other participant's device and in carrier metadata. Where the setting was enabled or left running after a dispute became foreseeable, the deletion may be treated as spoliation rather than as ordinary configuration.
Some jurisdictions permit a recording where one participant consents; others require the consent of everybody. A call spanning two states can engage both regimes. An unlawful recording may be inadmissible, may expose its maker to liability, and may taint other evidence, which makes the question worth answering before rather than after.
Metadata is information about a file rather than in it: when it was created and modified, by which account and application, and for images and messages a range of device and transmission details. It is generated automatically, which makes it hard to fake convincingly, and it is stripped or overwritten by ordinary handling, which makes preservation the whole exercise.
A screenshot records what a screen displayed at a moment chosen by whoever took it. It carries no metadata about the underlying message, it can be cropped to change the sense, and it can be fabricated trivially. Native exports, account downloads and device images all preserve what a screenshot discards, and they are usually available.
A photograph's recorded time comes from the device's clock, expressed in the zone the device was set to, and stored differently depending on the format. Comparing images from two devices, or one device that traveled, requires establishing both clocks before any conclusion is drawn. Corroboration from a source outside the camera resolves most of these questions quickly.
