Forensic Data Collection Explained For Lawyers

FORENSICCOLLECTION · AGUIDEFORUKLAWYERS Forensic Data Collection Explained for Lawyers Repeatability, Hashes, Metadata and the Chain of Custody COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CRIMPR PART 19 EXPERT EVIDENCE FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: copying is not collecting 03 What makes a collection forensic: the seven pillars 04 Pillar 1 · Repeatability 05 Pillar 2 · The audit trail 06 Pillar 3 · Timestamps 07 Pillar 4 · Hash verification 08 Pillar 5 · Source preservation 09 Pillar 6 · Metadata 10 Pillar 7 · Chain of custody 11 The standards frame: NPCC, FSR, ISO 12 Forensic collection and proportionality 13 Worked examples 14 Common mistakes and technical limitations 15 Questions to ask · Suggested wording 16 Checklist and red flags · When to involve a digital forensic expert 17 Frequently asked questions 18 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : COLLECTIONISANEVIDENTIALACT , NOTANITTASK § 0 2 · FIRSTPRINCIPLES The problem in plain English: copying is not collecting § 0 3 · THEMAP What makes a collection forensic: the seven pillars PILLAR IN ONE SENTENCE WHAT ITS ABSENCE COSTS 1 · Repeatability Method, tools, versions and settings documented so The collection becomes one person's 2 · Audit trail Contemporaneous logs of every action taken, by Gaps invite the inference that 3 · Timestamps Original file and system times preserved; collection The chronology (often the case) 4 · Hash verification Cryptographic fingerprints computed at acquisition No demonstrable identity between what 5 · Source preservation The original unaltered (write-blocked, read-only The best evidence is contaminated by 6 · Metadata Dates, authors, paths, permissions and system Documents float free of the history that 7 · Chain of custody An unbroken, signed record of possession, storage Admissibility friction, weight reduction, § 0 4 · PILLAR1 Repeatability § 0 5 · PILLAR2 The audit trail § 0 6 · PILLAR3 Timestamps § 0 7 · PILLAR4 Hash verification § 0 8 · PILLAR5 Source preservation § 0 9 · PILLAR6 Metadata § 1 0 · PILLAR7 Chain of custody § 1 1 · THEFRAMEWORK The standards frame: NPCC, FSR, ISO § 1 2 · SCALEWITHOUTSACRIFICE Forensic collection and proportionality § 1 3 · INTHEWILD Worked examples EXAMPLE1 · THEHELPFULITDEPARTMENT EXAMPLE2 · THECHALLENGETHATVERIFICATIONENDED EXAMPLE3 · TARGETED , ANDSTILLFORENSIC § 1 4 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 5 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTION PA R AG RAPHFORAFORENSICCOLLECTION § 1 6 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The forensic collection checklist Red flags When to involve a digital forensic expert § 1 7 · COMMONQUESTIONS Frequently asked questions Is evidence collected non-forensically inadmissible? Our IT team is competent. Why can they not do the collection? Does forensic collection mean imaging everything, at huge cost? What does forensic collection actually cost? The other side collected their disclosure casually. What do we do with that? How long should collected evidence and its records be kept? § 1 8 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY