Forensic Collection From Corporate File Servers

FILESERVEREVIDENCE · AGUIDEFORUKLAWYERS Forensic Collection from Corporate File Servers Shared Drives, Permissions, Snapshots, Deleted Files and the Attribution Problem COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES SERVER & LIVE-SYSTEM ACQUISITION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: everyone's drive, no one's machine 03 How server collection differs from device imaging 04 What the server records: permissions, audit and metadata 05 Snapshots, previous versions and deleted files 06 Attribution on shared systems 07 The collection playbook 08 Worked examples 09 Common mistakes and technical limitations 10 Questions to ask · Suggested wording 11 Checklist and red flags · When to involve a digital forensic expert 12 Frequently asked questions 13 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : COLLECTTHEFILES , THEHISTORYANDTHECONTEXT , ORTHE COLLECTIONANSWERSNOTHING § 0 2 · FIRSTPRINCIPLES The problem in plain English: everyone's drive, no one's machine § 0 3 · THEDIFFERENCESTHATMATTER How server collection differs from device imaging § 0 4 · WHATTHESERVERKNOWS What the server records: permissions, audit and metadata § 0 5 · THEHISTORYLAYER Snapshots, previous versions and deleted files § 0 6 · WHOSEHAND Attribution on shared systems § 0 7 · THEPLAYBOOK The collection playbook § 0 8 · INTHEWILD Worked examples EXAMPLE1 · THEVANISHEDCONTRACTSFOLDER , REBUILTFROMSNAPSHOTS EXAMPLE2 · " MODIFIEDBY " ANDTHEMIGRATIONTHATFOOLEDEVERYONE EXAMPLE3 · THEPRICINGFOLDERFORTYPEOPLECOULDREAD § 0 9 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 0 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · DAY- ONEPRESER VAT IONEMAILTOIT ( A DA PTANDSEND T O DAY ) SUGGESTEDWORDING · INSTRUCTIONFORASERVEREXAMIN AT ION § 1 1 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The file-server evidence checklist Red flags When to involve a digital forensic expert 35. Against an opponent, the same literacy runs in reverse: their server-based schedule of sins is tested against § 1 2 · COMMONQUESTIONS Frequently asked questions Can we just have IT export the relevant folders to save cost? The files we need were deleted from the share months ago. Are they gone? Can the server tell us who read a document, not just who changed it? The share lives in SharePoint/OneDrive now. Does this guide still apply? How disruptive is server collection to the business? § 1 3 · REFERENCE Glossary Sources and authoritative references 35 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY