Coordinating Forensic Collection Across Multiple Offices And Countries

MULTI - SITE & CROSS - BORDERCOLLECTION · AGUIDEFORUKLAWYERS Coordinating Forensic Collection Across Multiple Offices and Countries One Methodology, Many Sites: Consistency, Local Law and the Campaign Plan COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES MULTI-SITE CAMPAIGN COORDINATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many sites, one standard 03 The campaign model: hub, spokes and the methodology pack 04 Who collects where: laboratory teams, remote agents, local personnel 05 The legal terrain: transfers, blocking statutes and local process 06 Synchronisation, sequencing and tip-off risk 07 Moving and consolidating the evidence 08 The consolidated record: one campaign, one file 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CONSISTENCYISTHECAMPAIGN ' SPRODUCT § 0 2 · FIRSTPRINCIPLES The problem in plain English: many sites, one standard § 0 3 · THEARCHITECTURE The campaign model: hub, spokes and the methodology pack § 0 4 · HANDS Who collects where: laboratory teams, remote agents, local personnel § 0 5 · THELEGALTERRAIN The legal terrain: transfers, blocking statutes and local process § 0 6 · THECLOCK Synchronisation, sequencing and tip-off risk § 0 7 · FREIGHT Moving and consolidating the evidence § 0 8 · THEFILE The consolidated record: one campaign, one file § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESYNCHRONISEDFIRSTWAVE EXAMPLE2 · THESPOKETHATRANITSOWNSHOW EXAMPLE3 · THEBLOCKING - STATUTEPIVOT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations 39 plan with two site annexes does the work. § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CAM PA IGNCLAUSESFORTHEMASTERPROTOCOL SUGGESTEDWORDING · LOCALPERSONNELENG AG EMENT ( CORETERMS ) § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The multi-site campaign checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Do we really need local counsel in every country, or is that gold-plating? Can one UK laboratory really run a global campaign, or do we need providers in each country? How do we handle a jurisdiction that will not let the data leave? What does synchronisation actually require: must every site be the same hour? Who gives the expert evidence about a campaign executed by many hands? How much longer does a coordinated campaign take than letting sites run in parallel on their own? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab 35 where the matter warrants. Through e-discovery.uk , the consolidated evidence flows into a single processing Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY