Our client’s former employee indicated he never exchanged text messages with certain customers after his termination. A cell phone analysis of the subject’s iPhone’s messages supported his assertion, no messages between him and any customers were found.

But evidence of texting was identified in log files.

iPhones use iMessage when texting between other Apple devices, which is indicated as a blue message on the device, as opposed to green. A green message indicates an SMS text message that is logged by the cell phone provider, while the blue iMessages are sent in a different network. Which is really nice because you can see when iMessages have been delivered, when read, etc. The green messages will be recorded on the phone bill, while the blue ones are not, as they are part of Apple’s ecosystem. Which means the same messages can be obtained from a person’s iPad, MacBook, iMac, etc.

When an iPhone generates a text message, it uses Apple’s authorization service to determine if the recipient also has and Apple, or iMessage, and each of those authorizations is logged. We found dozens of log files between the subject and customers that indicate messages were exchanged. 

Liar, liar, pants on fire!