Page 1

FORENSIC COLLECTION · A GUIDE FOR UK LAWYERS Forensic Data Collection Explained for Lawyers Repeatability, Hashes, Metadata and the Chain of Custody COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CRIMPR PART 19 EXPERT EVIDENCE FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: copying is not collecting 03 What makes a collection forensic: the seven pillars 04 Pillar 1 · Repeatability 05 Pillar 2 · The audit trail 06 Pillar 3 · Timestamps 07 Pillar 4 · Hash verification 08 Pillar 5 · Source preservation 09 Pillar 6 · Metadata 10 Pillar 7 · Chain of custody 11 The standards frame: NPCC, FSR, ISO 12 Forensic collection and proportionality 13 Worked examples 14 Common mistakes and technical limitations 15 Questions to ask · Suggested wording 16 Checklist and red flags · When to involve a digital forensic expert 17 Frequently asked questions 18 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: COLLECTIONISANEVIDENTIALACT, NOT AN IT T ASK

§ 02 · FIRST PRINCIPLES The problem in plain English: copying is not collecting

§ 03 · THEMAP What makes a collection forensic: the seven pillars PILLAR IN ONE SENTENCE WHAT ITS ABSENCE COSTS 1 · Repeatability Method, tools, versions and settings documented so The collection becomes one person's 2 · Audit trail Contemporaneous logs of every action taken, by Gaps invite the inference that 3 · Timestamps Original file and system times preserved; collection The chronology (often the case) 4 · Hash verification Cryptographic fingerprints computed at acquisition No demonstrable identity between what 5 · Source preservation The original unaltered (write-blocked, read-only The best evidence is contaminated by 6 · Metadata Dates, authors, paths, permissions and system Documents float free of the history that 7 · Chain of custody An unbroken, signed record of possession, storage Admissibility friction, weight reduction,