Page 1

ACCESS & COMPULSION · A GUIDE FOR UK LAWYERS Collecting Without the Password Locked Devices, Withheld Credentials and the Law of Compelled Access COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES LOCKED-DEVICE ASSESSMENT COMPELLED-ACCESS SUPPORT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is there but locked away 03 What can and cannot be accessed technically 04 The civil routes: disclosure orders, unless orders and inference 05 The criminal route: the statutory notice regime for keys 06 Reaching the evidence another way: the estate around the locked device 07 Deployment: choosing the route and the consequences of refusal 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ALOCKEDDEVICEORWITHHELDPASSWORDISAPROBLEMWITH TWOHALVES: ANHONESTTECHNICALASSESSMENTOFWHATCANACTUALLYBE ACCESSED, ANDALAWFULLEGALROUTETOCOMPELOROBTAINTHEKEY, CHOSENFOR THE CIVIL OR CRIMINAL C ON TEXT, BECAUSESELF - HELPACCESSCANBEACRIMEAND MODERNENCRYPTIONISOFTENGENUINELYUNBREAKABLE

§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is there but locked away

§ 03 · WHATCANANDCANNOTBEACCESSED What can and cannot be accessed technically