Page 1

DELETIONATTRIBUTION · A GUIDE FOR UK LAWYERS Can You Prove Who Deleted a File? Deletion Artefacts, Audit Trails and the Attribution of an Absence COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FILE-SYSTEM JOURNAL ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: deletion is an act, and acts have actors 03 Cloud and server deletion: audit logs, recycle stages and admin actions 04 Local deletion: recycle bins, file-system journals and metadata residue 05 Deliberate erasure: wiping tools, anti-forensics and their own artefacts 06 Attribution: from account and profile to the person at the keyboard 07 Deployment: spoliation, employment, fraud and the innocent explanation 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DELETIONISRECORDEDBYTHEPLATFORM, THE FILE SYSTEM ANDTHEERASURETOOLITSELF: THERECORDNAMESANACCOUNTORPROFILE, THE CORROBORATIONNAMESTHEPERSON, ANDTHETIMINGAGAINSTTHEDUTYNAMESTHE CONSEQUENCE

§ 02 · FIRST PRINCIPLES The problem in plain English: deletion is an act, and acts have actors

§ 03 · CLOUDANDSERVERDELETION Cloud and server deletion: audit logs, recycle stages and admin actions