Page 1

TARGETEDCOLLECTION · A GUIDE FOR UK LAWYERS Can We Collect Only Relevant Data Instead of Imaging Everything? Targeted Collection: Its Proportionality Advantages and Its Honest Risks COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES TARGETED & FULL-IMAGE COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the estate and the needle 03 What targeted collection is, and is not 04 The proportionality case for collecting less 05 The risk register: what narrowing costs 06 Designing selection criteria that survive scrutiny 07 The forensic disciplines that must travel with it 08 The preservation backstop: making narrow safe 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: COLLECTLESS, DECIDEMORE, PRESERVEEVERYTHINGYOU MIGHTREGRET

§ 02 · FIRST PRINCIPLES The problem in plain English: the estate and the needle

§ 03 · DEFINITION What targeted collection is, and is not