Page 1
FILE SERVER EVIDENCE · A GUIDE FOR UK LAWYERS Forensic Collection from Corporate File Servers Shared Drives, Permissions, Snapshots, Deleted Files and the Attribution Problem COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES SERVER & LIVE-SYSTEM ACQUISITION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: everyone's drive, no one's machine 03 How server collection differs from device imaging 04 What the server records: permissions, audit and metadata 05 Snapshots, previous versions and deleted files 06 Attribution on shared systems 07 The collection playbook 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: COLLECTTHEFILES, THEHISTORYANDTHECONTEXT, ORTHE COLLECTIONANSWERSNOTHING
§ 02 · FIRST PRINCIPLES The problem in plain English: everyone's drive, no one's machine
§ 03 · THEDIFFERENCESTHATMATTER How server collection differs from device imaging
Page 2
§ 04 · WHATTHESERVERKNOWS What the server records: permissions, audit and metadata
§ 05 · THEHISTORYLAYER Snapshots, previous versions and deleted files
§ 06 · WHOSE H AND Attribution on shared systems
§ 07 · THEPLAYBOOK The collection playbook
§ 08 · IN THE WILD Worked examples EXAMPLE1 · THEVANISHEDCONTRACTSFOLDER, REBUILTFROMSNAPSHOTS EXAMPLE2 · " MODIFIEDBY " ANDTHEMIGRATIONTHATFOOLEDEVERYONE EXAMPLE3 · THEPRICINGFOLDERFORTYPEOPLECOULDREAD
§ 09 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
Page 3
§ 10 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · DAY- ON E PRESERVATION EMAIL TO IT ( A DA PTANDSEND TO DAY ) SUGGESTED WORDING · INSTRUCTION FOR A SERVER EXAM IN AT I ON
§ 11 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The file-server evidence checklist Red flags When to involve a digital forensic expert 35. Against an opponent, the same literacy runs in reverse: their server-based schedule of sins is tested against
§ 12 · COMMON QUESTIONS Frequently asked questions Can we just have IT export the relevant folders to save cost? The files we need were deleted from the share months ago. Are they gone? Can the server tell us who read a document, not just who changed it? The share lives in SharePoint/OneDrive now. Does this guide still apply? How disruptive is server collection to the business?
§ 13 · REFERENCE Glossary Sources and authoritative references 35 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Forensic Collection From Corporate File Servers, Computer Forensics Lab, https://e-discovery.uk/library/forensic-collection-from-corporate-file-servers/pdf.