Page 1
MULTI - SITE & CROSS - B ORDER COLLECTION · A GUIDE FOR UK LAWYERS
Coordinating Forensic Collection Across
Multiple Offices and Countries
One Methodology, Many Sites: Consistency, Local Law and the Campaign
Plan
COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR
PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES MULTI-SITE CAMPAIGN COORDINATION
CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS
In this guide
01 Executive summary
02 The problem in plain English: many sites, one standard
03 The campaign model: hub, spokes and the methodology pack
04 Who collects where: laboratory teams, remote agents, local personnel
05 The legal terrain: transfers, blocking statutes and local process
06 Synchronisation, sequencing and tip-off risk
07 Moving and consolidating the evidence
08 The consolidated record: one campaign, one file
09 Worked examples
10 Common mistakes and technical limitations
11 Questions to ask · Suggested wording
12 Checklist and red flags · When to involve a digital forensic expert
13 Frequently asked questions
14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION
Executive summary
THE HEADLINE POINT: CONSISTENCYISTHECAMPAIGN ' SPRODUCT
§ 02 · FIRST PRINCIPLES
The problem in plain English: many sites, one standard
§ 03 · THEARCHITECTURE
The campaign model: hub, spokes and the methodology pack
Page 2
§ 04 · HANDS
Who collects where: laboratory teams, remote agents, local
personnel
§ 05 · THELEGALTERRAIN
The legal terrain: transfers, blocking statutes and local process
§ 06 · THECLOCK
Synchronisation, sequencing and tip-off risk
§ 07 · FREIGHT
Moving and consolidating the evidence
§ 08 · THEFILE
The consolidated record: one campaign, one file
§ 09 · IN THE WILD
Worked examples
EXAMPLE1 · THESYNCHRONISEDFIRSTWAVE
EXAMPLE2 · THESPOKETHATRANITSOWNSHOW
EXAMPLE3 · THEBLOCKING - STATUTEPIVOT
Page 3
§ 10 · WHEREITGOESWRONG
Common mistakes and technical limitations
Common mistakes
Technical limitations
39 plan with two site annexes does the work.
§ 11 · INTERROGATORIES & DRAFTING AIDS
Questions to ask · Suggested wording
Ask your client
Ask your opponent
Ask your e Discovery / forensic provider
SUGGESTED WORDING · CAM PA IGNCLAUSESFORTHEMASTERPROTOCOL
SUGGESTED WORDING · LOCALPERSONNELENG AG EMENT ( CORETERMS )
§ 12 · QUICK CONTROL
Checklist and red flags · When to involve a digital forensic
expert
The multi-site campaign checklist
Red flags
When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS
Frequently asked questions
Do we really need local counsel in every country, or is that gold-plating? Can one UK laboratory really run a global campaign, or do we need providers in each country? How do we handle a jurisdiction that will not let the data leave? What does synchronisation actually require: must every site be the same hour? Who gives the expert evidence about a campaign executed by many hands? How much longer does a coordinated campaign take than letting sites run in parallel on their own?
§ 14 · REFERENCE
Glossary
Sources and authoritative references
DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST
Working with Computer Forensics Lab
35 where the matter warrants. Through e-discovery.uk, the consolidated evidence flows into a single processing
Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB
NEWENQUIRIESEMAILE - DISCOVERY