Collecting Without The Password

ACCESS & COMPULSION · AGUIDEFORUKLAWYERS Collecting Without the Password Locked Devices, Withheld Credentials and the Law of Compelled Access COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES LOCKED-DEVICE ASSESSMENT COMPELLED-ACCESS SUPPORT CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is there but locked away 03 What can and cannot be accessed technically 04 The civil routes: disclosure orders, unless orders and inference 05 The criminal route: the statutory notice regime for keys 06 Reaching the evidence another way: the estate around the locked device 07 Deployment: choosing the route and the consequences of refusal 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ALOCKEDDEVICEORWITHHELDPASSWORDISAPROBLEMWITH TWOHALVES : ANHONESTTECHNICALASSESSMENTOFWHATCANACTUALLYBE ACCESSED , ANDALAWFULLEGALROUTETOCOMPELOROBTAINTHEKEY , CHOSENFOR THECIVILORCRIMINALCONTEXT , BECAUSESELF - HELPACCESSCANBEACRIMEAND MODERNENCRYPTIONISOFTENGENUINELYUNBREAKABLE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the evidence is there but locked away § 0 3 · WHATCANANDCANNOTBEACCESSED What can and cannot be accessed technically § 0 4 · THECIVILROUTES The civil routes: disclosure orders, unless orders and inference § 0 5 · THECRIMINALROUTE The criminal route: the statutory notice regime for keys § 0 6 · REACHINGAROUNDIT Reaching the evidence another way: the estate around the locked device § 0 7 · DEPLOYMENT Deployment: choosing the route and the consequences of refusal § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION COUNTERPART LOCKED CLOUD RECOVERY- SERVER-SIDE COMPULSION DEVICE BACKUP KEY STORE PLATFORMS ROUTE SYNCED / COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEUNBREAKABLEPHONEANDTHEBACKUPTHATWASNOT EXAMPLE2 · THEUNLESSORDERANDTHESUDDENRECOLLECTION EXAMPLE3 · THECORPORATEDEVICETHATWASNEVERREALLYLOCKED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or the reluctant party) Ask your eDiscovery / forensic provider § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The locked-access checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can you just crack the password on a locked phone? Can a civil court make someone hand over their password? Is there a law that forces someone to decrypt data? Can we just try to guess the password or get into the account ourselves? The device is locked and encryption is unbreakable. Is the case lost? The employee returned a locked company laptop. What now? § 1 4 · REFERENCE Glossary Sources and authoritative references 31 · CPR Part 35: justice.gov.uk, Part DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY