Page 1
TARGETEDCOLLECTION · A GUIDE FOR UK LAWYERS Can We Collect Only Relevant Data Instead of Imaging Everything? Targeted Collection: Its Proportionality Advantages and Its Honest Risks COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES TARGETED & FULL-IMAGE COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the estate and the needle 03 What targeted collection is, and is not 04 The proportionality case for collecting less 05 The risk register: what narrowing costs 06 Designing selection criteria that survive scrutiny 07 The forensic disciplines that must travel with it 08 The preservation backstop: making narrow safe 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: COLLECTLESS, DECIDEMORE, PRESERVEEVERYTHINGYOU MIGHTREGRET
§ 02 · FIRST PRINCIPLES The problem in plain English: the estate and the needle
§ 03 · DEFINITION What targeted collection is, and is not
Page 2
§ 04 · THE CASE FOR LESS The proportionality case for collecting less
§ 05 · THEOTHERCOLUMN The risk register: what narrowing costs
§ 06 · THECRAFT Designing selection criteria that survive scrutiny
§ 07 · THECONSTANTS The forensic disciplines that must travel with it
§ 08 · THEBACKSTOP The preservation backstop: making narrow safe
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THETARGETEDCOLLECTIONTHATBEATTHEDEADLINEANDTHEBUDGET EXAMPLE2 · THEFOLDERNOBODYMENTIONED EXAMPLE3 · THEEXFILTRATIONLIMBTHATGREW
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SCOPE AND B AC KSTOPCLAUSESFORTHEPROTOCOL SUGGESTED WORDING · DRD / CORRESPONDENCEDESCRIPTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The targeted-collection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Will a court criticise us for not imaging everything? Is it safer to image everything if the client will pay? Can we use keyword filters to reduce what we collect? What if we discover mid-case that our criteria missed something? How do we challenge an opponent whose "targeted collection" looks like cherry-picking? Does targeted collection satisfy our preservation duty by itself?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Can We Collect Only Relevant Data Instead Of Imaging Everything, Computer Forensics Lab, https://e-discovery.uk/library/can-we-collect-only-relevant-data-instead-of-imaging-everything/pdf.