Page 1
ACCESS & COMPULSION · A GUIDE FOR UK LAWYERS Collecting Without the Password Locked Devices, Withheld Credentials and the Law of Compelled Access COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES LOCKED-DEVICE ASSESSMENT COMPELLED-ACCESS SUPPORT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is there but locked away 03 What can and cannot be accessed technically 04 The civil routes: disclosure orders, unless orders and inference 05 The criminal route: the statutory notice regime for keys 06 Reaching the evidence another way: the estate around the locked device 07 Deployment: choosing the route and the consequences of refusal 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ALOCKEDDEVICEORWITHHELDPASSWORDISAPROBLEMWITH TWOHALVES: ANHONESTTECHNICALASSESSMENTOFWHATCANACTUALLYBE ACCESSED, ANDALAWFULLEGALROUTETOCOMPELOROBTAINTHEKEY, CHOSENFOR THE CIVIL OR CRIMINAL C ON TEXT, BECAUSESELF - HELPACCESSCANBEACRIMEAND MODERNENCRYPTIONISOFTENGENUINELYUNBREAKABLE
§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is there but locked away
§ 03 · WHATCANANDCANNOTBEACCESSED What can and cannot be accessed technically
Page 2
§ 04 · THECIVILROUTES The civil routes: disclosure orders, unless orders and inference
§ 05 · THECRIMINALROUTE The criminal route: the statutory notice regime for keys
§ 06 · REACHINGAROUNDIT Reaching the evidence another way: the estate around the locked device
§ 07 · DEPLOYMENT Deployment: choosing the route and the consequences of refusal
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION COUNTERPART LOCKED CLOUD RECOVERY- SERVER-SIDE COMPULSION DEVICE BACKUP KEY STORE PLATFORMS ROUTE SYNCED / COPIES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEUNBREAKABLEPHONEANDTHEBACKUPTHATWASNOT EXAMPLE2 · THEUNLESSORDERANDTHESUDDENRECOLLECTION EXAMPLE3 · THECORPORATEDEVICETHATWASNEVERREALLYLOCKED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or the reluctant party) Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The locked-access checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can you just crack the password on a locked phone? Can a civil court make someone hand over their password? Is there a law that forces someone to decrypt data? Can we just try to guess the password or get into the account ourselves? The device is locked and encryption is unbreakable. Is the case lost? The employee returned a locked company laptop. What now?
§ 14 · REFERENCE Glossary Sources and authoritative references 31 · CPR Part 35: justice.gov.uk, Part DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Collecting Without The Password, Computer Forensics Lab, https://e-discovery.uk/library/collecting-without-the-password/pdf.