Page 1

EDISCLOSUREVSDIGITALFORENSICS · A GUIDE FOR UK LAWYERS e Disclosure or Digital Forensics? Choosing the Correct Approach COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: two disciplines, one costly confusion 03 The four disciplines defined: acquisition, exam in at i on, processing, review 04 Where they overlap, and where they must not be substituted 05 Why the choice matters legally 06 The decision tree: ordinary collection, forensic preservation, or investigation? 07 The ten forensic triggers 08 Practical workflow: triage at the outset, escalation mid-matter 09 Collection methods compared: cost, intrusion, evidential yield 10 Realistic litigation examples 11 Proportionality, privilege and UK GDPR when forensics enters the frame 12 Common mistakes and technical limitations 13 Questions to ask: client, opponent, provider 14 Suggested wording for instructions 15 Checklist and red flags 16 Frequently asked questions 17 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE ANSWER, WHENDOESADISCLOSUREMATTERACTUALLYREQUIRE FORENSIC EXAM IN AT I ON?

§ 02 · FIRST PRINCIPLES The problem in plain English: two disciplines, one costly confusion

§ 03 · DEFINITIONS The four disciplines defined 1 · Forensic acquisition 2 · Forensic exam in at i on 3 · e Discovery processing 4 · Legal document review FORENSIC EDISCOVERY ACQUISITION PROCESSING FORENSIC EXAM IN AT I ON LEGAL REVIEW