Page 1
MULTI - SITE & CROSS - B ORDER COLLECTION · A GUIDE FOR UK LAWYERS Coordinating Forensic Collection Across Multiple Offices and Countries One Methodology, Many Sites: Consistency, Local Law and the Campaign Plan COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES MULTI-SITE CAMPAIGN COORDINATION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many sites, one standard 03 The campaign model: hub, spokes and the methodology pack 04 Who collects where: laboratory teams, remote agents, local personnel 05 The legal terrain: transfers, blocking statutes and local process 06 Synchronisation, sequencing and tip-off risk 07 Moving and consolidating the evidence 08 The consolidated record: one campaign, one file 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CONSISTENCYISTHECAMPAIGN ' SPRODUCT
§ 02 · FIRST PRINCIPLES The problem in plain English: many sites, one standard
§ 03 · THEARCHITECTURE The campaign model: hub, spokes and the methodology pack
Page 2
§ 04 · HANDS Who collects where: laboratory teams, remote agents, local personnel
§ 05 · THELEGALTERRAIN The legal terrain: transfers, blocking statutes and local process
§ 06 · THECLOCK Synchronisation, sequencing and tip-off risk
§ 07 · FREIGHT Moving and consolidating the evidence
§ 08 · THEFILE The consolidated record: one campaign, one file
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESYNCHRONISEDFIRSTWAVE EXAMPLE2 · THESPOKETHATRANITSOWNSHOW EXAMPLE3 · THEBLOCKING - STATUTEPIVOT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations 39 plan with two site annexes does the work.
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · CAM PA IGNCLAUSESFORTHEMASTERPROTOCOL SUGGESTED WORDING · LOCALPERSONNELENG AG EMENT ( CORETERMS )
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The multi-site campaign checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Do we really need local counsel in every country, or is that gold-plating? Can one UK laboratory really run a global campaign, or do we need providers in each country? How do we handle a jurisdiction that will not let the data leave? What does synchronisation actually require: must every site be the same hour? Who gives the expert evidence about a campaign executed by many hands? How much longer does a coordinated campaign take than letting sites run in parallel on their own?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 where the matter warrants. Through e-discovery.uk, the consolidated evidence flows into a single processing Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Coordinating Forensic Collection Across Multiple Offices And Countries, Computer Forensics Lab, https://e-discovery.uk/library/coordinating-forensic-collection-across-multiple-offices-and-countries/pdf.