Page 1

DEDUPLICATION · A GUIDE FOR UK LAWYERS Deduplication Explained Hashes, Scope Choices and Why "the Same Document" Is a Legal Question COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EDRM PROCESSING PRACTICE

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the copies that eat the budget 03 How it works: hashes and what counts as identical 04 The scope decision: custodian-level vs matter-level 05 Email's special problems: near-copies that are not twins 06 Keeping what suppression hides: custodian tables and copy evidence 07 The forensic cousin: hashing as copy-tracing evidence 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DEDUPLICATETOREVIEWONCE, BUTRECORDWHOELSEHELD EVERY COPY: SUPPRESSIONMUSTLOSECOST, NOT EVIDENCE

§ 02 · FIRST PRINCIPLES The problem in plain English: the copies that eat the budget

§ 03 · THEMECHANICS How it works: hashes and what counts as identical 83) handles resemblance; dedup handles identity only.