Can We Collect Only Relevant Data Instead Of Imaging Everything

TARGETEDCOLLECTION · AGUIDEFORUKLAWYERS Can We Collect Only Relevant Data Instead of Imaging Everything? Targeted Collection: Its Proportionality Advantages and Its Honest Risks COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES TARGETED & FULL-IMAGE COLLECTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the estate and the needle 03 What targeted collection is, and is not 04 The proportionality case for collecting less 05 The risk register: what narrowing costs 06 Designing selection criteria that survive scrutiny 07 The forensic disciplines that must travel with it 08 The preservation backstop: making narrow safe 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : COLLECTLESS , DECIDEMORE , PRESERVEEVERYTHINGYOU MIGHTREGRET § 0 2 · FIRSTPRINCIPLES The problem in plain English: the estate and the needle § 0 3 · DEFINITION What targeted collection is, and is not § 0 4 · THECASEFORLESS The proportionality case for collecting less § 0 5 · THEOTHERCOLUMN The risk register: what narrowing costs § 0 6 · THECRAFT Designing selection criteria that survive scrutiny § 0 7 · THECONSTANTS The forensic disciplines that must travel with it § 0 8 · THEBACKSTOP The preservation backstop: making narrow safe § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THETARGETEDCOLLECTIONTHATBEATTHEDEADLINEANDTHEBUDGET EXAMPLE2 · THEFOLDERNOBODYMENTIONED EXAMPLE3 · THEEXFILTRATIONLIMBTHATGREW § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SCOPEANDB AC KSTOPCLAUSESFORTHEPROTOCOL SUGGESTEDWORDING · DRD / CORRESPONDENCEDESCRIPTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The targeted-collection checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Will a court criticise us for not imaging everything? Is it safer to image everything if the client will pay? Can we use keyword filters to reduce what we collect? What if we discover mid-case that our criteria missed something? How do we challenge an opponent whose "targeted collection" looks like cherry-picking? Does targeted collection satisfy our preservation duty by itself? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY