Page 1
COLLECTION METHOD S · A GUIDE FOR UK LAWYERS Forensic Image, Logical Extraction or Targeted Collection? Choosing the Right Depth of Acquisition, Source by Source COMPUTER FORENSICS LAB · E-DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a false binary 03 The three methods, properly defined 04 The comparison table 05 Matching method to evidential need 06 Cost and proportionality: the chain consequences 07 The decision tree 08 The honest risk register of each method 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DEPTHISCHOSENPERSOURCE, ANDTHEOPTIONTOGODEEPER ISPRESERVED
§ 02 · FIRST PRINCIPLES The problem in plain English: a false binary
§ 03 · TERMSOFART The three methods, properly defined Forensic (physical) image Logical extraction Targeted collection
Page 2
§ 04 · SIDEBYSIDE The comparison table FORENSIC IMAGE LOGICAL EXTRACTION TARGETED COLLECTION
§ 05 · FIT Matching method to evidential need
§ 06 · THEMONEY Cost and proportionality: the chain consequences
§ 07 · THEDECISION The decision tree
§ 08 · HONESTLEDGER The honest risk register of each method Forensic image
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEHYBRIDTHATFITTEDTHECASE EXAMPLE2 · THEBLANKETINSTRUCTION EXAMPLE3 · THETRIGGERTHATFIRED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION PA R AG RAPH ( METHOD PER SOURCE WITH TRIGGERS ) SUGGESTED WORDING · DRD / CORRESPONDENCE PA R AG RAPHEXPLAININGAMIXED APPR OAC H
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The method-selection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is targeted collection defensible, or will we be criticised for not imaging? Can we start light and upgrade to imaging later if needed? Do we need to image every custodian's laptop? How do phones fit this framework? Roughly what does each method cost? What should we do when the other side chose the wrong method for a contested source?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Forensic Image Logical Extraction Or Targeted Collection, Computer Forensics Lab, https://e-discovery.uk/library/forensic-image-logical-extraction-or-targeted-collection/pdf.