Page 1
DELETIONATTRIBUTION · A GUIDE FOR UK LAWYERS Can You Prove Who Deleted a File? Deletion Artefacts, Audit Trails and the Attribution of an Absence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FILE-SYSTEM JOURNAL ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: deletion is an act, and acts have actors 03 Cloud and server deletion: audit logs, recycle stages and admin actions 04 Local deletion: recycle bins, file-system journals and metadata residue 05 Deliberate erasure: wiping tools, anti-forensics and their own artefacts 06 Attribution: from account and profile to the person at the keyboard 07 Deployment: spoliation, employment, fraud and the innocent explanation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DELETIONISRECORDEDBYTHEPLATFORM, THE FILE SYSTEM ANDTHEERASURETOOLITSELF: THERECORDNAMESANACCOUNTORPROFILE, THE CORROBORATIONNAMESTHEPERSON, ANDTHETIMINGAGAINSTTHEDUTYNAMESTHE CONSEQUENCE
§ 02 · FIRST PRINCIPLES The problem in plain English: deletion is an act, and acts have actors
§ 03 · CLOUDANDSERVERDELETION Cloud and server deletion: audit logs, recycle stages and admin actions
Page 2
§ 04 · LOCALDELETION Local deletion: recycle bins, file-system journals and metadata residue
§ 05 · DELIBERATEERASURE Deliberate erasure: wiping tools, anti-forensics and their own artefacts
§ 06 · ATTRIBUTION Attribution: from account and profile to the person at the keyboard
§ 07 · DEPLOYMENT Deployment: spoliation, employment, fraud and the innocent explanation
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION DEVICE TOOL PLATFORM RECYCLE FILE-SYSTEM ESTATE AUDIT LOG STAGES STRUCTURES REDUNDANCY SESSION / ERASURE- LAYER ARTEFACTS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEPURGEAT23: 12ANDTHEACCOUNTTHATDIDIT EXAMPLE2 · THECLEANLAPTOPANDTHECLEANER ' SRECEIPT EXAMPLE3 · THEDELETIONTHATWASAPOLICY, ANDTHEALLEGATIONTHATWAS WITHDRAWN
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORDELETION AT TRIBUTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The deletion-attribution checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions If a file is gone, how can anyone know who deleted it? Does emptying the recycle bin remove the evidence of deletion? The laptop came back wiped. Is there anything to find? Can we prove it was the person and not just their account? Our client did delete the files, but before any dispute. Does that matter? What if the deletion was done by a retention policy or an administrator?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Can You Prove Who Deleted A File, Computer Forensics Lab, https://e-discovery.uk/library/can-you-prove-who-deleted-a-file/pdf.