Page 1

VDI & REMOTEDESKTOPEVIDENCE · A GUIDE FOR UK LAWYERS Citrix, VDI and Remote Desktop: Where the Evidence Actually Resides Session Hosts, Golden Images, Profile Stores and the Endpoint That Holds Almost Nothing COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM VDI & SESSION-HOST COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: imaging the window 03 The architectures in plain English: RDS, Citrix, VDI 04 Persistent versus non-persistent: the question that decides everything 05 Where the user's world actually lives: profiles and redirection 06 The connection record: brokers, gateways and session logs 07 What the end point does keep 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: FOLLOWTHESESSION, NOTTHESCREEN

§ 02 · FIRST PRINCIPLES The problem in plain English: imaging the window

§ 03 · THEESTATES The architectures in plain English: RDS, Citrix, VDI