Digital Redaction That Cannot Be Reversed

DIGITALREDACTION · AGUIDEFORUKLAWYERS Digital Redaction That Cannot Be Reversed Why Black Rectangles Fail, How Real Redaction Works, and How to Verify It COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FAILED-REDACTION EXAMINATION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: covering is not removing 03 Where content hides: text layers, metadata, embeds and revisions 04 How real redaction works: burn-in, sanitisation and the pipeline 05 The hard formats: spreadsheets, natives, images and media 06 Verification: testing your own redactions before they leave 07 Receiving redacted productions: audit, challenge and recovery ethics 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : REDACTIONISREMOVALOFDATA , NOTCONCEALMENTOF PIXELS : BURNIN , SANITISE , VERIFY , ANDKEEPTHEAUDITRECORDTHATPROVESALL THREE § 0 2 · FIRSTPRINCIPLES The problem in plain English: covering is not removing § 0 3 · THEHIDINGPLACES Where content hides: text layers, metadata, embeds and revisions § 0 4 · THEPIPELINE How real redaction works: burn-in, sanitisation and the pipeline § 0 5 · THEHARDFORMATS The hard formats: spreadsheets, natives, images and media § 0 6 · THEGATE Verification: testing your own redactions before they leave § 0 7 · THERECEIVINGCHAIR Receiving redacted productions: audit, challenge and recovery ethics § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives WHERE THE THREAD DMS / UNREDACTED CONTENT INSTANCES VERSIONS ORIGINALS ALSO LIVES (GUIDE 83) (GUIDE 75) (RING) DUPLICATES BACKUPS / COUNTERPART (GUIDE 82) ARCHIVES COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THERECTANGLESTHATLIFTEDOFF EXAMPLE2 · THETHREADREDACTEDINONEPLACEANDQUOTEDINANOTHER EXAMPLE3 · THESPREADSHEETTHATCOMPUTEDITSOWNSECRETS 88 §4 completed: spreadsheets are computation, not pages, and their redaction is an engineering task § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · R E DAC TION PA R AG RAPHFORTHEDISCLOSUREPROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The redaction checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions We drew black boxes in our PDF tool. Is that not redaction? Do we really need to worry about metadata on redacted documents? Can we redact a spreadsheet by deleting the sensitive cells? The other side's redaction has failed and we can read the content. Can we use it? Is blurring or pixelating text an acceptable redaction? How do we prove our redactions are sound if challenged? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY