Page 1
ACCESS CONTROL EVIDENCE · A GUIDE FOR UK LAWYERS Door Access, Swipe Cards and Building Logs Physical Presence Evidence and What a Badge Event Does and Does Not Prove COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM TIMELINE CONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the building keeps a diary 03 The access-control estate: readers, controllers and platforms 04 What the logs record and how to read them 05 Attribution: card, credential and human 06 Collection and retention: getting the logs before they go 07 Joining presence to the digital timeline 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: BADGELOGSPLACEACREDENTIALPRECISELY: MAKINGTHEM PLACEAPERSONISTHEANALYTICALWORK
§ 02 · FIRST PRINCIPLES The problem in plain English: the building keeps a diary
§ 03 · THEESTATE The access-control estate: readers, controllers and platforms
Page 2
§ 04 · THERECORD What the logs record and how to read them
§ 05 · WHOSE H AND Attribution: card, credential and human
§ 06 · BEFOREITGOES Collection and retention: getting the logs before they go
§ 07 · THEJOIN Joining presence to the digital timeline
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE TURNSTILES / CONTROLLERS / CCTV DIGITAL TIME & DELETED / PLATFORM LAYER PERIPHERY ATTENDANCE RECOVERABLE LIFTS / VISITORS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEOVERTIMETHATBADGEDITSELFOUT EXAMPLE2 · THESERVERROOMAT02: 12, AND WHOSE H AND EXAMPLE3 · THEABSENCETHATPROVEDNOTHING, HONESTLY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · AC CESS - CONTROLLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The access-control checklist Red flags When to involve a digital forensic expert 35. Through e-discovery.uk, the building's diary sits on the same reviewed chronology as everything else the
§ 13 · COMMON QUESTIONS Frequently asked questions How long are swipe logs actually kept? Can badge data alone prove someone was in the building? The logs show no exit for our witness. When did they leave? Our client says a colleague borrowed their card. Hopeless? Is building access data caught by disclosure duties like documents? Can employers freely use this data to investigate staff?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Door Access Swipe Cards And Building Logs, Computer Forensics Lab, https://e-discovery.uk/library/door-access-swipe-cards-and-building-logs/pdf.