Door Access Swipe Cards And Building Logs

ACCESSCONTROLEVIDENCE · AGUIDEFORUKLAWYERS Door Access, Swipe Cards and Building Logs Physical Presence Evidence and What a Badge Event Does and Does Not Prove COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM TIMELINE CONSTRUCTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the building keeps a diary 03 The access-control estate: readers, controllers and platforms 04 What the logs record and how to read them 05 Attribution: card, credential and human 06 Collection and retention: getting the logs before they go 07 Joining presence to the digital timeline 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : BADGELOGSPLACEACREDENTIALPRECISELY : MAKINGTHEM PLACEAPERSONISTHEANALYTICALWORK § 0 2 · FIRSTPRINCIPLES The problem in plain English: the building keeps a diary § 0 3 · THEESTATE The access-control estate: readers, controllers and platforms § 0 4 · THERECORD What the logs record and how to read them § 0 5 · WHOSEHAND Attribution: card, credential and human § 0 6 · BEFOREITGOES Collection and retention: getting the logs before they go § 0 7 · THEJOIN Joining presence to the digital timeline § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE TURNSTILES / CONTROLLERS / CCTV DIGITAL TIME & DELETED / PLATFORM LAYER PERIPHERY ATTENDANCE RECOVERABLE LIFTS / VISITORS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEOVERTIMETHATBADGEDITSELFOUT EXAMPLE2 · THESERVERROOMAT02 : 1 2 , ANDWHOSEHAND EXAMPLE3 · THEABSENCETHATPROVEDNOTHING , HONESTLY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · AC CESS - CONTROLLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The access-control checklist Red flags When to involve a digital forensic expert 35. Through e-discovery.uk , the building's diary sits on the same reviewed chronology as everything else the § 1 3 · COMMONQUESTIONS Frequently asked questions How long are swipe logs actually kept? Can badge data alone prove someone was in the building? The logs show no exit for our witness. When did they leave? Our client says a colleague borrowed their card. Hopeless? Is building access data caught by disclosure duties like documents? Can employers freely use this data to investigate staff? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY