Page 1

FILE - SHARINGPLATFORMS · A GUIDE FOR UK LAWYERS Forensic Evidence from Dropbox, Box and Share File Sync Artefacts, Activity Logs and Sharing Trails on the Independent File Platforms COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES FILE-PLATFORM COLLECTION SYNC-CLIENT ARTEFACT ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the third file platform nobody mapped 03 The platform record: version histories, activity logs and sharing trails 04 The desktop clients: local sync databases and machine artefacts 05 Sharing, links and external collaboration: who reached the data 06 Preservation and collection: admin export, API and legal process 07 Deployment: disclosure, exfiltration and the account nobody admits to 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DROPBOX, BOXANDSHAREFILEEACHKEEPAPLATFORM - SIDE EVERY MACHINE: COLLECTBOTH, BECAUSETHEPLATFORMPROVESWHATHAPPENED ANDTHECLIENTCORROBORATESITWHERETHEACCOUNTISDENIEDORGONE

§ 02 · FIRST PRINCIPLES The problem in plain English: the third file platform nobody mapped

§ 03 · THEPLATFORMRECORD The platform record: version histories, activity logs and sharing trails