EDisclosure Or Digital Forensics Choosing The Correct Approach

EDISCLOSUREVSDIGITALFORENSICS · AGUIDEFORUKLAWYERS eDisclosure or Digital Forensics? Choosing the Correct Approach COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: two disciplines, one costly confusion 03 The four disciplines defined: acquisition, examination, processing, review 04 Where they overlap, and where they must not be substituted 05 Why the choice matters legally 06 The decision tree: ordinary collection, forensic preservation, or investigation? 07 The ten forensic triggers 08 Practical workflow: triage at the outset, escalation mid-matter 09 Collection methods compared: cost, intrusion, evidential yield 10 Realistic litigation examples 11 Proportionality, privilege and UK GDPR when forensics enters the frame 12 Common mistakes and technical limitations 13 Questions to ask: client, opponent, provider 14 Suggested wording for instructions 15 Checklist and red flags 16 Frequently asked questions 17 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEANSWER , WHENDOESADISCLOSUREMATTERACTUALLYREQUIRE FORENSICEXAMINATION ? § 0 2 · FIRSTPRINCIPLES The problem in plain English: two disciplines, one costly confusion § 0 3 · DEFINITIONS The four disciplines defined 1 · Forensic acquisition 2 · Forensic examination 3 · eDiscovery processing 4 · Legal document review FORENSIC EDISCOVERY ACQUISITION PROCESSING FORENSIC EXAMINATION LEGAL REVIEW § 0 4 · THEJOINS Where they overlap, and where they must not be substituted Overlap 1 · Collection feeds both pipelines Overlap 2 · Review surfaces forensic questions Overlap 3 · The same providers, different hats WHATMUSTNEVERBESUBSTITUTED § 0 5 · CONSEQUENCES Why the choice matters legally § 0 6 · THEDECISION The decision tree: ordinary collection, forensic preservation, or investigation? QUESTION1 YESNO QUESTION2 QUESTION3 QUESTION4 QUESTION5 ORDINARYCOLLECTIONBUTKEEPW AT C H § 0 7 · ESCALATIONSIGNALS The ten forensic triggers TRIGGER WHY FORENSICS, NOT EDISCLOSURE 1 · A document's authenticity is Authenticity lives in metadata, structure and provenance artefacts, examination 2 · Deletion is suspected or admitted Recovery from unallocated space, databases and backups, and, equally 4 · Chronology anomalies: dates that Backdating and timeline manipulation are proven or explained through file- 7 · The source is locked, encrypted, Laboratory acquisition methods (and lawful-authority questions) beyond 8 · An opponent's disclosure smells Grounds for specific disclosure, natives-with-metadata requests, or an § 0 8 · INPRACTICE Practical workflow: triage at the outset, escalation mid-matter At the outset: the 48-hour triage Mid-matter: the escalation protocol FORTHEPRACTITIONER STEP ACTION 3 Forensically acquire everything marked volatile, suspect or trigger-positive, before broader planning, 4 Route the remainder into documented platform collection and standard processing. 5 Record the triage in the methodology memo: source, decision, trigger(s), date, decider. This memo is § 0 9 · METHODSELECTION Collection methods compared: cost, intrusion, evidential yield RELATIVE INTRUSION § 1 0 · INTHEWILD Realistic litigation examples EXAMPLE1 · WHEREORDINARYCOLLECTIONWASTHERIGHTCALL EXAMPLE2 · WHEREFORENSICSWASNEEDEDFROMDAYONE EXAMPLE3 · THEMID - MATTERESCALATION § 1 1 · CONSTRAINTS Proportionality, privilege and UK GDPR when forensics enters the frame § 1 2 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 3 · INTERROGATORIES Questions to ask Ask your client Ask your opponent Ask a forensic / eDisclosure provider § 1 4 · DRAFTINGAIDS Suggested wording for instructions SCOPEDFORENSICEXAMIN AT ION ESCAL AT ION PA R AG RAPHFORAREVIEWPROTOCOL § 1 5 · QUICKCONTROL Checklist and red flags The triage checklist Red flags: forensics is (or was) needed § 1 6 · COMMONQUESTIONS Frequently asked questions When does a disclosure matter actually require forensic examination? Can we start with ordinary collection and go forensic later if something emerges? Is a forensic image always better, then? Our IT team already looked at the laptop. Is it ruined? Can we make the other side hand over their devices for imaging? Who should give the evidence, the provider who processed our disclosure? § 1 7 · REFERENCE Glossary Authoritative UK references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab 35 / CrimPR Part 19, and independent-examiner appointments under privilege protocols; our e-discovery team Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY