Question 1

Have we identified all potentially relevant systems?

Accepted Answer

You can never prove that you have; you can prove that you would have found what mattered. That means dual- track interviews (custodians and IT separately), the signed questionnaire in §13, and the five cross-checks in §12, finance records, SSO application lists, device reconciliation, sampling of collected data, and contract review, with every source, decision and reason recorded in a versioned data map. When a late source surfaces (one usually does), a documented process absorbs it as routine; an undocumented one turns it into an accusation.

Question 2

Do we really have to deal with employees' personal phones and accounts?

Accepted Answer

Where they have been used for work on the matters in issue, yes, they are squarely in scope, and courts increasingly expect the DRD to address them expressly. The route is consent, targeted extraction (relevant apps, threads and dates, not the whole device) and transparency with the custodian, balancing the disclosure duty against their own data-protection rights. Silence on the topic is the one in defensible position.

Question 3

How far do we go with backups?

Accepted Answer

Preserve first (pause the rotation for in-scope systems, cheap), restore later and selectively (expensive). PD 31B expressly treats accessibility and restoration cost as reasonable-search factors, so the defensible pattern is: catalogue what snapshots exist, preserve them, and negotiate restoration only where live sources cannot answer the question, typically where deletion is in issue.

Question 4

Is CCTV really our problem in a commercial dispute?

Accepted Answer

Whenever physical presence, deliveries, meetings, access or timing could matter, yes, and it is the fastest-dying source on the map. The cost of a same-week forensic export is trivial; the cost of explaining a 14-day overwrite cycle to a judge is not. Check the DVR clock against real time when export in g and record the offset.

Question 5

What about systems run by our IT provider, are they "ours" to disclose?

Accepted Answer

Data an MSP or provider holds on the client's behalf is generally within the client's control for disclosure purposes: the client must preserve and produce it, and the provider should receive a preservation notice on day one. Genuinely third-party data (carriers' records, platforms' logs, counterparties' files) is different, that is CPR 31.17, witness summons or Norwich Pharmacal territory, and the preservation letter still goes first.

Question 6

Who should run identification, lawyers, the client, or a provider?

Accepted Answer

Lawyers own it (the outputs underwrite the certificate), the client's people supply it, and a provider accelerates it, particularly the technical cross-checks and volatile-source preservation. What must not happen is delegation to the client alone: self-identification has all the weaknesses of self-collection, one stage earlier. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 22 of 25

Guide 4: Finding the Evidence - A Lawyer's Map of Modern Electronic Data Sources