Most in-house counsel substantially over-estimate what their company can recover from a personal device covered under a BYOD or MDM policy. The forensic reality is narrower than the policy language suggests.
What MDM typically captures on a personal device:
- Application inventory (which apps are installed)
- Compliance posture (OS version, encryption status, jailbreak detection)
- Selective work-app remote-wipe capability
- For some platforms, basic location and connection telemetry
What MDM generally does NOT capture without intrusive enrollment:
- Personal messaging content (iMessage, WhatsApp, Signal)
- Personal email
- Personal photos and files
- Personal browsing history
- Personal call logs
For investigations involving personal device evidence, the gap between policy and capability is consequential. A policy that "permits inspection of company data on personal devices" rarely permits forensic imaging of the entire device. And in many jurisdictions, attempting it without explicit, contemporaneous consent creates legal exposure for the employer.
Practical implications:
1. Build the BYOD policy with the matter you might face in mind. Generic templates routinely under-deliver on the forensic-investigation use case.
2. When a matter arises, get fresh consent. The policy alone is rarely sufficient for forensic acquisition of personal devices.
3. Calibrate expectations. Personal device evidence is harder and more contested than corporate-device evidence.