Page 1

ACCESS CONTROL EVIDENCE · A GUIDE FOR UK LAWYERS Door Access, Swipe Cards and Building Logs Physical Presence Evidence and What a Badge Event Does and Does Not Prove COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM TIMELINE CONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the building keeps a diary 03 The access-control estate: readers, controllers and platforms 04 What the logs record and how to read them 05 Attribution: card, credential and human 06 Collection and retention: getting the logs before they go 07 Joining presence to the digital timeline 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: BADGELOGSPLACEACREDENTIALPRECISELY: MAKINGTHEM PLACEAPERSONISTHEANALYTICALWORK

§ 02 · FIRST PRINCIPLES The problem in plain English: the building keeps a diary

§ 03 · THEESTATE The access-control estate: readers, controllers and platforms