Finding The Evidence A Lawyers Map Of Modern Electronic Data Sources

DATASOURCEIDENTIFICATION · AGUIDEFORUKLAWYERS Finding the Evidence A Lawyer's Map of Modern Electronic Data Sources COMPUTERFORENSICSLAB · E - DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English, and why identification is a legal duty 03 How to read the map: custodians, systems, control and volatility 04 The map · Endpoints: computers, laptops, phones and tablets 05 The map · Communications: email, messaging apps, Teams, Slack, social media 06 The map · Storage: file servers, NAS, cloud storage and backups 07 The map · Business systems: SaaS, CRM, ERP, databases and finance 08 The map · Ambient and physical: CCTV, access control, telephony, IoT 09 The map · Infrastructure and logs: identity, network, MDM, audit trails 10 The map · Third-party providers, and the legal routes to their data 11 The volatility league table: what dies first 12 "Have we identified all potentially relevant systems?" Proving a defensible process 13 The custodian and source questionnaire (Parts A, B and C) 14 Common mistakes and technical limitations 15 Questions for the opponent and the provider · Suggested instruction wording 16 Checklist and red flags · When to involve a digital forensic expert 17 Frequently asked questions 18 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary § 0 2 · FIRSTPRINCIPLES The problem in plain English: why identification is a legal duty FORTHEPRACTITIONER § 0 3 · READINGTHEMAP How to read the map: custodians, systems, control and volatility § 0 4 · THEMAP · ENDPOINTS Computers, laptops, phones and tablets IDENTIFICATIONQUESTIONSTHATFINDENDPOINTS SOURCE WHAT IT HOLDS VOLATILIT Y & ACCESS WHERE IT HIDES / WHAT LAWYERS MISS § 0 5 · THEMAP · COMMUNICATIONS Email, messaging applications, Teams, Slack and social media § 0 6 · THEMAP · STORAGE File servers, NAS, cloud storage and backups § 0 7 · THEMAP · BUSINESSSYSTEMS SaaS platforms, CRM, ERP, databases and finance systems § 0 8 · THEMAP · AMBIENT & PHYSICAL CCTV, access control, telephony and the Internet of Things § 0 9 · THEMAP · INFRASTRUCTURE & LOGS Identity, network, MDM and audit trails SOURCE WHAT IT HOLDS LITIGATION USE · VOLATILIT Y § 1 0 · THEMAP · THIRDPARTIES Third-party providers, and the legal routes to their data HOLDER WHAT THEY HOLD ROUTE TO THE DATA § 1 1 · DECAYRATES The volatility league table: what dies first RANK SOURCE WEEK-ONE ACTION T YPICAL SURVIVAL (DEFAULT CONFIGS) 1 CCTV / dashcam loops Hours to ~31 days Forensic export today; record clock 3 Chat platforms with retention timers 30–90 days Suspend the policy in-platform, day 4 SSO / audit logs (M365, Google, Okta) 30–180 days by tier Export the window; upgrade tier if 5 Leavers' accounts and devices Per leaver process, often 30 Freeze the process; pull devices from 6 Disappearing-message threads Per timer, hours to 90 days Timers off in writing; extract the 7 Cloud recycle bins / deleted-item 30–180 days Litigation hold; export deleted-item 8 Backup rotations Per schedule, the relevant Pause rotation for in-scope systems; 9 Handsets in circulation Until lost, upgraded or reset Extract key custodians' devices early 10 Live mailboxes, drives, servers under Stable once held Ordinary collection timetable 11 Archives, ERP history, completed Years Scope for proportionality; no urgency § 1 2 · THECOMPLETENESSQUESTION "Have we identified all potentially relevant systems?" Proving a defensible process CROSS-CHECK WHAT IT CATCHES 1 · Dual-track interviews Run IT/systems interviews (Part B) and custodian interviews (Part A) separately and 2 · Follow the money Twelve months of accounts payable and corporate-card statements, filtered for software 4 · Follow the devices Reconcile the asset register against MDM enrolment and mailbox-access device lists. 5 · Read the data you already Sample the first-collected mailboxes for tell-tales: links to unlisted platforms, notifications § 1 3 · THEINSTRUMENT The custodian and source questionnaire Part A · Custodian questionnaire (per person) ROLEANDCONTE XT DEVICES EMAILAND AC COUNTS MESS AG INGANDCOLLABOR AT ION DOCUMENTSANDSTOR AG E SYSTEMS CONDUCTANDEVENTS Part B · IT and systems questionnaire (per organisation / MSP) E S TAT EANDINVENTORY RETENTIONANDDELETION LOGSANDSECURITY PHYSICALANDAMBIENT THIRD PA RTIESANDCHANGE Part C · Legal-team cross-checks (from records) § 1 4 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 5 · INTERROGATORIES & DRAFTINGAIDS Questions for the opponent and the provider · Suggested instruction wording Ask your opponent (DRD / EDQ / correspondence) Ask an eDiscovery / forensic provider Suggested wording · Third-party preservation letter (core paragraphs) Suggested wording · Custodian identification instruction § 1 6 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The identification checklist Red flags When to involve a digital forensic expert § 1 7 · COMMONQUESTIONS Frequently asked questions Have we identified all potentially relevant systems? Do we really have to deal with employees' personal phones and accounts? How far do we go with backups? Is CCTV really our problem in a commercial dispute? What about systems run by our IT provider, are they "ours" to disclose? Who should run identification, lawyers, the client, or a provider? § 1 8 · REFERENCE Glossary BYOD CDR DVR / NVR EDQ MDM MSP Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY