Not unilaterally. A personal device is the employee's property and imaging it without clear authority creates privacy and statutory exposure that can exceed the underlying dispute. The routes are consent, a negotiated preservation agreement, a court order, or a neutral examiner protocol that produces only responsive material.
Why a BYOD policy is weaker than it looks
Many employers believe a bring-your-own-device policy gives them inspection rights. Sometimes it does, within limits. But a policy signed at onboarding is generally construed narrowly, is often silent on forensic imaging as opposed to accessing work data, and does not necessarily survive the employee's departure.
More importantly, the policy governs the employment relationship. It does not by itself answer the statutory questions — wiretap and stored-communications statutes, state computer-crime laws, and privacy regimes that in some jurisdictions treat an employee's personal device as protected regardless of what they agreed to.
The practical position: treat a policy as helpful context, not as authority, and get advice on the specific jurisdiction before touching the device.
The four workable routes
Consent. Informed, in writing, and specific about what will be imaged and what will be examined. Consent to "review work-related material" is not consent to a full physical extraction of a personal phone, and treating it as such is how these matters go wrong.
A negotiated preservation agreement. Frequently the fastest route once counsel is involved on both sides — the device is imaged and the image held, unexamined, pending agreement or an order on scope. This stops the evidence disappearing while the scope argument proceeds, which is usually the urgent problem.
A court order. Available, and courts grant it where the showing is made, but it takes time the evidence may not have.
A forensic neutral protocol. An independent examiner images the device, applies agreed search parameters, and produces only responsive material to the parties. Courts have been notably receptive to this because it resolves the real objection — a phone contains the person's entire life, and handing it wholesale to an opponent is disproportionate to almost any dispute.
Why the neutral route usually wins
It separates two things that otherwise get argued together: whether the device can be examined at all, and what the examining party gets to see. Once the second is answered by a protocol, the first stops being existential for the device owner, and the objection frequently softens.
It also produces one examination rather than two competing ones, and findings that carry more weight because they did not come from either side's expert.
Preserve what you unambiguously control, now
Uncertainty about the personal device should not delay the rest. The company's own systems, the employee's corporate accounts, VPN and proxy logs, and any company-issued hardware are preservable immediately and often answer the question without the phone — a large transfer to a personal cloud account is visible in the company's own egress records.
In practice the phone is frequently confirmatory rather than essential, and the matters that fail are the ones where the company waited on the phone question while its own short-retention logs rotated away.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.