Written by Adam Sandman, Senior Vice President – Sales & Marketing
Ask an HR director, a compliance officer, or in-house counsel what went wrong the last time an internal investigation stalled, and the answer is rarely a tool. It is almost always a decision that nobody made in time. Who had authority to collect. What the scope was. Whether the messages that mattered were still on the device by the time anyone thought to look.
Email lives on a server the company controls. Mobile data lives in someone’s pocket. That single difference explains most of what goes wrong when an investigation turns on text messages, WhatsApp threads, or a departing employee’s phone.
The phone in the drawer
The scenario comes up constantly. An employee leaves, the company-issued phone comes back, and it ends up in a drawer with a Post-it note. Months later, the data on that phone becomes relevant to a matter and nobody knows how to get into it, who has authority to open it, or whether the data is still intact.
That is not a technology failure. It is a process failure that existed long before anyone thought to collect anything.
The fix is upstream. Collect targeted data from company devices at offboarding, before the phone is wiped and reissued. It is faster and cheaper than reconstructing what was on a device six months later.
Mobile data does not wait
Teams routinely assume the data will still be there when they are ready to collect. With mobile data, it rarely is. Messages across iMessage, WhatsApp, Teams, and WeChat can be deleted, overwritten, or aged out automatically through retention settings and disappearing-message features. By the time legal or investigations teams get involved, the critical conversations may already be gone or incomplete.
The first 48 hours matter more than any other window in the investigation. In that time, the preservation notice should specifically name mobile devices and messaging apps, not just “documents and email.” The custodian interview should ask which apps they actually use for work. And someone should check whether any of those apps have auto-delete enabled, because if they do, the clock is already running.
Scope like you will have to justify it
There is a persistent instinct to collect everything from a device because it feels safer. In internal investigations, the opposite is true. Overcollection increases review cost, extends timelines, exposes personal data the organization then has an obligation to protect, and in many jurisdictions puts the company on the wrong side of proportionality.
Defensible scope has four dimensions: the participants the custodian communicated with, the applications in use for the conduct at issue, a date range tied to the allegation with a reasonable buffer, and the data types the allegation actually requires. Scope can always expand later with a documented reason. Defending a full device image you cannot justify is a much harder position.
The test: are we collecting more because we need it, or because our process is not precise enough to collect less?
The custodian experience is now part of defensibility
A senior leader who is a key custodian refuses to hand over a personal phone. This is one of the most common blockers in internal investigations, and it is almost always a scope problem rather than a cooperation problem. Ask for the whole phone and you get a lawyer. Ask for three apps over six months, collected remotely while they keep the device, and cooperation changes.
A confusing, invasive, or disruptive process creates resistance, escalation, and sometimes a second dispute layered on top of the first. In a mobile-first workplace, friction is a risk factor.
Authentication does not come from grabbing the whole device
An investigation outcome is only as strong as the ability to prove the evidence was not altered. That proof does not require a full file system extraction. It comes from complete message data with metadata (timestamps, participants, directionality, attachments), hashing and integrity validation, and a chain of custody the process generates automatically rather than one reconstructed from a spreadsheet afterward.
Manual, ad hoc chain-of-custody logs are increasingly described across the industry as failure points waiting for a challenge. If the audit trail depends on someone remembering to write it down correctly every time, it is the weakest link in the record.
A repeatable process is the point
None of this is complicated on its own. What makes it hard is running it the same way every time, under pressure, across HR, legal, compliance, and IT. Repeatability is what holds up when an investigation is later challenged, and it only exists if the decisions are made in the same order on every matter.
We put the full six-phase process, the questions to answer at each stage, and a scenario quick reference for departing employees, misconduct complaints, trade secret theft, disappearing messages, reluctant executives, and cross-border custodians into one guide. Download the Internal Investigations Playbook: Mobile Evidence Edition.