Ask a question about disclosure, digital forensics or evidence handling and get an answer drawn from the text of our published UK guides, with citations you can open at the exact passage.
Ask a question in plain English. The assistant reads the full text of every guide and Knowledge Centre article, answers from what it finds and points you to the most relevant PDF.
Answers come from published material only and are general information, not legal advice. Conversations are saved in this browser.
Answers are drawn only from the wording of our published guides and Knowledge Centre articles, with a citation you can open at the exact passage. This is general information about our published material, not legal advice. Browse the full library or read the library FAQ.
These are the questions visitors ask most often, each one answered in full from the wording of the published guides rather than a single FAQ line, with the guide in the Knowledge Centre that covers the subject in depth.
If your IT team has already looked at the laptop, the evidence is not necessarily ruined, but it has been changed.
Guide in the Knowledge Centre: Investigating Suspected Employee Data Theft
Sources: Investigating Suspected Employee Data Theft, EDisclosure Or Digital Forensics Choosing The Correct Approach, Damaged Computers And Data Recovery
Put this to the assistantA forensic image is not always better, as imaging every data source is disproportionate and creates unnecessary hosting and disposal obligations.
Guide in the Knowledge Centre: EDisclosure Or Digital Forensics Choosing The Correct Approach
Sources: EDisclosure Or Digital Forensics Choosing The Correct Approach, Forensic Image Logical Extraction Or Targeted Collection
Put this to the assistantYou can only partially start with an ordinary collection and upgrade to a forensic approach later.
Guide in the Knowledge Centre: EDisclosure Or Digital Forensics Choosing The Correct Approach
Sources: EDisclosure Or Digital Forensics Choosing The Correct Approach, Forensic Data Collection Explained For Lawyers, Can We Collect Only Relevant Data Instead Of Imaging Everything, Preparing A Forensic Collection Protocol
Put this to the assistantA disclosure matter requires forensic examination when an issue turns on authenticity, deletion, alteration, backdating, attribution, exfiltration or device usage, or when a source is…
Guide in the Knowledge Centre: EDisclosure Or Digital Forensics Choosing The Correct Approach
Sources: EDisclosure Or Digital Forensics Choosing The Correct Approach, Initial Disclosure What Should Be Provided And What Should Be Preserved
Put this to the assistantControl does not end simply because a party no longer holds the document.
Guide in the Knowledge Centre: Control Of Electronic Documents What Lawyers Need To Investigate
Sources: Control Of Electronic Documents What Lawyers Need To Investigate
Put this to the assistantIf a foreign subsidiary refuses to provide documents or local law blocks their transfer, you must take all permissible steps to obtain them and provide the English court with evidence of any genuine…
Guide in the Knowledge Centre: Control Of Electronic Documents What Lawyers Need To Investigate
Sources: Control Of Electronic Documents What Lawyers Need To Investigate, Custodian Abroad Cross Border Collection
Put this to the assistantThe provided context does not explicitly answer whether data in the cloud legally belongs to the provider, but it does explain how an employer can recover their material from an employee's personal…
Guide in the Knowledge Centre: Data Exfiltration To Cloud Storage
Sources: Data Exfiltration To Cloud Storage
Put this to the assistantYes, you are expected to deal with employees' personal WhatsApp messages where they were used for relevant work.
Guide in the Knowledge Centre: BYOD And Disclosure
Sources: BYOD And Disclosure, Control Of Electronic Documents What Lawyers Need To Investigate
Put this to the assistantA parent or subsidiary company's documents do not automatically count as yours, as shareholding alone does not constitute control.
Under the principles of CPR 31.
Guide in the Knowledge Centre: Control Of Electronic Documents What Lawyers Need To Investigate
Sources: Control Of Electronic Documents What Lawyers Need To Investigate
Put this to the assistantUnder CPR 31.8 and PD 57AD, a party has control of an electronic document if they have or had physical possession, a right to…
Guide in the Knowledge Centre: Control Of Electronic Documents What Lawyers Need To Investigate
Sources: Control Of Electronic Documents What Lawyers Need To Investigate
Put this to the assistantMeasured costs arguments do indeed move courts, as the e-disclosure regime is built around proportionate cost and judicial budget management.
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs, Early Data Assessment Before Disclosure Costs Escalate, Proportionality In EDisclosure When Is Enough Enough, Electronic Disclosure Explained A Practical Guide For UK Lawyers
Put this to the assistantYou should only push for fixed fees on measurable stages like collection and processing, while capping estimable work and leaving contingent stages unit-priced.
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs
Put this to the assistantThe true cost of hosting over a matter is calculated by multiplying the promoted gigabytes by the monthly rate and the honest duration of the case, and then adding the cost of user…
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs, Domain DNS And Hosting Records
Put this to the assistantE-disclosure costs are generally recoverable from the losing party as costs of the proceedings, provided they meet the usual tests of being reasonably incurred, reasonable in amount and proportionate.
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs, Electronic Disclosure Explained A Practical Guide For UK Lawyers, Cooperating On Electronic Disclosure Without Giving Away Your Case
Put this to the assistantTechnology Assisted Review (TAR) is genuinely cheaper for larger document populations, but the financial benefit depends entirely on the volume of documents and the specific economics of your matter.
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs, Technology Assisted Review For UK Lawyers, What Is A Reasonable Electronic Search
Put this to the assistantDisclosure bills usually exceed estimates due to unbudgeted data expansion, inefficient workflows, unpriced scope creep, and inaccurate review pace assumptions.
Guide in the Knowledge Centre: Understanding And Controlling EDisclosure Costs
Sources: Understanding And Controlling EDisclosure Costs, Early Data Assessment Before Disclosure Costs Escalate
Put this to the assistantYes, you can add or remove custodians after the Disclosure Review Document (DRD) is completed, and well-run matters usually do.
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure
Put this to the assistantA Chief Executive Officer is not automatically considered a custodian simply because of their job title.
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure
Put this to the assistantYes, former employees count as custodians whenever they were participants in the relevant events.
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure
Put this to the assistantA shared mailbox is not a custodian, but rather a non-custodial source that must be collected as a repository in its own right.
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure, Shared Mailboxes Delegated Access And Who Really Sent The Email
Put this to the assistantThere is no single normal number of custodians, but modest commercial disputes commonly involve four to eight, substantial B&PC claims run from eight to 20, and regulatory or fraud…
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure
Put this to the assistantA custodian is a person or identity whose data holdings are treated as a single unit of collection, search and review during a disclosure exercise.
Guide in the Knowledge Centre: Guide 5: Identifying the Right Custodians in Electronic Disclosure
Sources: Identifying The Right Custodians In Electronic Disclosure
Put this to the assistantWhen an employee returns a locked company laptop, the first step is to check for the recovery key before attempting any other action.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, BitLocker FileVault And Full Disk Encryption, Investigating Suspected Employee Data Theft, Mac Evidence In Litigation
Put this to the assistantA locked device with unbreakable encryption rarely means the case is lost, because the lock guards the physical device rather than the underlying data.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, FileVault The Secure Enclave And Apple Encryption, BitLocker FileVault And Full Disk Encryption, Locked Mobile Devices
Put this to the assistantYou must not try to guess the password or access the account yourself, as doing so is a criminal offence and ruins the evidence.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, MacOS And Apple Silicon Forensics
Put this to the assistantYes, there are legal mechanisms to force the decryption of data, but the specific laws and tools depend on whether the context is a criminal investigation or a civil dispute.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, Locked Mobile Devices
Put this to the assistantYes, a civil court can require a party to hand over their passwords and keys as part of their disclosure obligations.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, Locked Mobile Devices
Put this to the assistantThe ability to crack a locked phone is conditional, as older devices may yield but modern phones with strong passcodes often have encryption that brute force cannot defeat in a useful timeframe.
Guide in the Knowledge Centre: Collecting Without The Password
Sources: Collecting Without The Password, Mobile Phone Forensics
Put this to the assistanttraceable to CONTEXT?* Yes. * *At least one short verbatim quotation?* Yes ("every exhibit, reference, seal and location").
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection, Browser History And Internet Artefacts, The First EDisclosure Meeting 50 Questions Lawyers Should Ask
Put this to the assistantWhether you need to tell staff what is happening is a lawyer's decision made during the planning stage, balancing transparency with the risk of tipping off suspects.
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection, The First EDisclosure Meeting 50 Questions Lawyers Should Ask, Investigating Suspected Employee Data Theft, Technical Preparation For A Disclosure Case Management Conference
Put this to the assistantIf you discover devices on site that are not on the schedule, the standard contingency is to record them, preserve them, and immediately refer the scope question to the designated decision…
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection
Put this to the assistantThe decision to image devices on site or take them to the laboratory must be made per device and by plan, depending on hardware health, business needs, and the context of…
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection, Remote Employee Collection, Should A Computer Be Imaged While Running Or Switched Off
Put this to the assistantThe business can largely keep working during a collection, provided that careful planning has been put in place beforehand.
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection, Remote Employee Collection, Investigating Suspected Employee Data Theft
Put this to the assistantAn on-site collection typically takes a single day for a handful of machines, two to three days for a small office, and requires a planned campaign for anything larger…
Guide in the Knowledge Centre: Planning An On Site Digital Evidence Collection
Sources: Planning An On Site Digital Evidence Collection
Put this to the assistantAn employee's consent can sometimes allow you to collect their device abroad, but it cannot be assumed to be a complete legal basis on its own.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, Remote Employee Collection, Remote Forensic Collection When Can It Be Defensible
Put this to the assistantIf foreign law blocks disclosure, you must inform the English court candidly and early, providing evidence of the constraint and demonstrating that you are doing the lawful maximum to comply.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, Control Of Electronic Documents What Lawyers Need To Investigate, Electronic Disclosure Explained A Practical Guide For UK Lawyers
Put this to the assistantCloud-side collection can avoid much of the problem when data resides in a UK-controlled corporate account, but it does not completely eliminate local law considerations.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, Can We Collect Only Relevant Data Instead Of Imaging Everything, Remote Employee Collection
Put this to the assistantMoving data to England is not just a logistics question, as it constitutes a restricted international transfer under the UK GDPR that requires a lawful transfer mechanism.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, Coordinating Forensic Collection Across Multiple Offices And Countries
Put this to the assistantA blocking statute is a foreign law that criminalises the gathering or exporting of evidence located in that country for use in foreign proceedings outside of official channels.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, Collecting Without The Password
Put this to the assistantNo, an English court order does not make it lawful to collect and export data located in another country.
Guide in the Knowledge Centre: Custodian Abroad Cross Border Collection
Sources: Custodian Abroad Cross Border Collection, BYOD And Disclosure, EDisclosure Or Digital Forensics Choosing The Correct Approach
Put this to the assistantEvery pair below comes from a published guide. Open the guide for the full wording, or put the question to the assistant above.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.
