Business is conducted by text, and messages are frequently the most probative evidence in a commercial dispute.

Preservation. Immediately on a duty arising: instruct custodians not to delete, to disable auto-delete, to back up the device, and not to trade in or reset the phone. Device replacement after a hold is a recurring source of sanctions.

Collection. Forensic extraction preserves metadata, deleted content and attachments. Screenshots lose timestamps, sender identification and context, and are challenged on authentication.

Personal devices. Where the employer’s policy asserts rights over business communications on personal devices, the messages are within the party’s control. Where it does not, collection depends on consent, and the absence of a policy is what makes this difficult.

Authentication. Testimony from a participant; phone records; distinctive content; reply patterns; and forensic evidence of the extraction.

Production format. Agree the format in the ESI protocol — a conversation view with participants, timestamps and attachments — because message-by-message production is unintelligible.

Group chats and messaging applications raise the same issues with the added complication that many are not backed up and some are designed not to be.

Policy fix. A written policy asserting rights and prohibiting business use of ephemeral applications.