Page 1
EDISCLOSUREVSDIGITALFORENSICS · A GUIDE FOR UK LAWYERS e Disclosure or Digital Forensics? Choosing the Correct Approach COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: two disciplines, one costly confusion 03 The four disciplines defined: acquisition, exam in at i on, processing, review 04 Where they overlap, and where they must not be substituted 05 Why the choice matters legally 06 The decision tree: ordinary collection, forensic preservation, or investigation? 07 The ten forensic triggers 08 Practical workflow: triage at the outset, escalation mid-matter 09 Collection methods compared: cost, intrusion, evidential yield 10 Realistic litigation examples 11 Proportionality, privilege and UK GDPR when forensics enters the frame 12 Common mistakes and technical limitations 13 Questions to ask: client, opponent, provider 14 Suggested wording for instructions 15 Checklist and red flags 16 Frequently asked questions 17 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE ANSWER, WHENDOESADISCLOSUREMATTERACTUALLYREQUIRE FORENSIC EXAM IN AT I ON?
§ 02 · FIRST PRINCIPLES The problem in plain English: two disciplines, one costly confusion
§ 03 · DEFINITIONS The four disciplines defined 1 · Forensic acquisition 2 · Forensic exam in at i on 3 · e Discovery processing 4 · Legal document review FORENSIC EDISCOVERY ACQUISITION PROCESSING FORENSIC EXAM IN AT I ON LEGAL REVIEW
Page 2
§ 04 · THEJOINS Where they overlap, and where they must not be substituted Overlap 1 · Collection feeds both pipelines Overlap 2 · Review surfaces forensic questions Overlap 3 · The same providers, different hats WHATMUSTNEVERBESUBSTITUTED
§ 05 · CONSEQUENCES Why the choice matters legally
§ 06 · THEDECISION The decision tree: ordinary collection, forensic preservation, or investigation? QUESTION1 YESNO QUESTION2 QUESTION3 QUESTION4 QUESTION5 ORDINARYCOLLECTIONBUTKEEPW AT CH
§ 07 · ESCALATIONSIGNALS The ten forensic triggers TRIGGER WHY FORENSICS, NOT EDISCLOSURE 1 · A document's authenticity is Authenticity lives in metadata, structure and provenance artefacts, exam in at i on 2 · Deletion is suspected or admitted Recovery from unallocated space, databases and backups, and, equally 4 · Chronology anomalies: dates that Backdating and timeline manipulation are proven or explained through file- 7 · The source is locked, encrypted, Laboratory acquisition methods (and lawful-authority questions) beyond 8 · An opponent's disclosure smells Grounds for specific disclosure, natives-with-metadata requests, or an
§ 08 · IN PRACTICE Practical workflow: triage at the outset, escalation mid-matter At the outset: the 48-hour triage Mid-matter: the escalation protocol FOR THE PRACTITIONER STEP ACTION 3 Forensically acquire everything marked volatile, suspect or trigger-positive, before broader planning, 4 Route the remainder into documented platform collection and standard processing. 5 Record the triage in the methodology memo: source, decision, trigger(s), date, decider. This memo is
§ 09 · METHODSELECTION Collection methods compared: cost, intrusion, evidential yield RELATIVE INTRUSION
Page 3
§ 10 · IN THE WILD Realistic litigation examples EXAMPLE1 · WHEREORDINARYCOLLECTIONWASTHERIGHTCALL EXAMPLE2 · WHEREFORENSICSWASNEEDEDFROMDAYONE EXAMPLE3 · THEMID - MATTERESCALATION
§ 11 · CONSTRAINTS Proportionality, privilege and UK GDPR when forensics enters the frame
§ 12 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 13 · INTERROGATORIES Questions to ask Ask your client Ask your opponent Ask a forensic / e Disclosure provider
§ 14 · DRAFTING AIDS Suggested wording for instructions SCOPE D FORENSIC EXAM IN AT I ON ESCAL AT ION PA R AG RAPHFORAREVIEWPROTOCOL
§ 15 · QUICK CONTROL Checklist and red flags The triage checklist Red flags: forensics is (or was) needed
Page 4
§ 16 · COMMON QUESTIONS Frequently asked questions When does a disclosure matter actually require forensic exam in at i on? Can we start with ordinary collection and go forensic later if something emerges? Is a forensic image always better, then? Our IT team already looked at the laptop. Is it ruined? Can we make the other side hand over their devices for imaging? Who should give the evidence, the provider who processed our disclosure?
§ 17 · REFERENCE Glossary Authoritative UK references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 / CrimPR Part 19, and independent-examiner appointments under privilege protocols; our e-discovery team Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, EDisclosure Or Digital Forensics Choosing The Correct Approach, Computer Forensics Lab, https://e-discovery.uk/library/edisclosure-or-digital-forensics-choosing-the-correct-approach/pdf.