A reader recently asked for an app to capture text messages – a very understandable request. Here are some DIY options to consider.
Most everyone is familiar with this irritating and incomplete approach, which involves taking partial images of texts that end up overlapping. Screenshots are a pain, often lack date and time stamps, don’t capture contact information or other metadata, and must be combined somehow to form a PDF. Not a great way to go. Next, please.
Decipher TextMessage and Tansee for iOS
The Decipher TextMessage app uses five simple steps to capture text messages for export to PDF. Unlike the screenshot method, it automatically grabs date and time stamps, attachments, and accurate contact information for senders and recipients. It can also recover deleted conversations.
Decipher TextMessage is $29.99 and uses the iTunes interface. If you’re dubious about spending thirty bucks sight unseen, take advantage of the free trial, but this app has a lot going for it. Read more about Decipher TextMessage here.
Tansee iPhone Transfer SMS is another great DIY solution at the same price point for a three-year license. It uses its own proprietary software installed on your desktop rather than iTunes.
The clean printout rendered by (Tansee) allows for a seamless production. (Users can) Bates-stamp each PDF page and produce the thread in one comprehensive file, rather than in disjointed screenshot images pieced together in an unorganized manner. Use of this software allows for a more efficient in-house review process, as well as a more transparent production set to opposing counsel.
A disadvantage of this software is that it does not retain the actual native file, merely an organized photocopy with some of the relevant metadata attached to each message.
SMS Backup+ is a free app in the Google Play Store that allows users to store texts in a gmail account. Conversations can be printed to PDF using a web browser. Sounds simple enough, but since this is a backup program it can only capture what is presently stored on a phone. There is no mechanism to restore deleted conversations. Another downside: reviewers say the app is buggy. However, as one noted: “I tried other SMS Backup apps, but they are not the same or as good! This app is significantly better (in my opinion).”
The evidentiary concerns surrounding use of text messages are substantial. As mentioned, accurate date and time stamps and true identities of senders and recipients are critical. Capturing location data, attachments, and special characters can be troublesome. SeeHow to Print Text Messages for Use as Evidence.
As this post points out, before extracting evidence from smart devices consider employing expert forensic help – not just to get it right, but to secure an independent witness if authenticity isn’t stipulated.
Common law imposes a duty to preserve potentially-relevant information in anticipation of litigation
Most information is electronically-stored information (ESI)
Understanding ESI entails knowledge of information storage media, encodings and formats
There are many types of e-storage media of differing capacities, form factors and formats:a) analog (phonograph record) or digital (hard drive, thumb drive, optical media)b) mechanical (electromagnetic hard drive, tape, etc.) or solid-state (thumb drive, SIM card, etc.)
Computers don’t store “text,” “documents,” “pictures,” “sounds.” They only store bits (ones or zeroes)a) ASCII or Unicode for alphanumeric characters;b) JPG for photos, DOCX for Word files, MP3 for sound files, etc.
Digital information is encoded as numbers by applying various encoding schemes:
We express these numbers in a base or radix (base 2 binary, 10 decimal, 16 hexadecimal, 60 sexagesimal). E-mail messages encode attachments in base 64.
The bigger the base, the smaller the space required to notate and convey the information
Digitally encoded information is stored (written):a) physically as bytes (8-bit blocks) in sectors and partitionsb) logically as clusters, files, folders and volumes
Files use binary header signatures to identify file formats (type and structure) of data
Operating systems use file systems to group information as files and manage filenames and metadata
File systems employ filename extensions (e.g., .txt, .jpg, .exe) to flag formats
All ESI includes a component of metadata (data about data) even if no more than needed to locate it
A file’s metadata may be greater in volume or utility than the contents of the file it describes
File tables hold system metadata about the file (e.g., name, locations on disk, MAC dates): it’s CONTEXT
Files hold application metadata (e.g., EXIF geolocation data in photos, comments in docs): it’s CONTENT
File systems allocate clusters for file storage; deleting files releases cluster allocations for reuse
If unallocated clusters aren’t reused, deleted files may be recovered (“carved”) via computer forensics
Forensic (“bitstream”) imaging is a method to preserve both allocated and unallocated clusters
Because data are numbers, data can be digitally “fingerprinted” using one-way hash algorithms (MD5, SHA1)
Hashing facilitates identification, deduplication and de-NISTing of ESI in e-discovery