Forensic Image Logical Extraction Or Targeted Collection

COLLECTIONMETHODS · AGUIDEFORUKLAWYERS Forensic Image, Logical Extraction or Targeted Collection? Choosing the Right Depth of Acquisition, Source by Source COMPUTERFORENSICSLAB · E - DISCOVERY . U K § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a false binary 03 The three methods, properly defined 04 The comparison table 05 Matching method to evidential need 06 Cost and proportionality: the chain consequences 07 The decision tree 08 The honest risk register of each method 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : DEPTHISCHOSENPERSOURCE , ANDTHEOPTIONTOGODEEPER ISPRESERVED § 0 2 · FIRSTPRINCIPLES The problem in plain English: a false binary § 0 3 · TERMSOFART The three methods, properly defined Forensic (physical) image Logical extraction Targeted collection § 0 4 · SIDEBYSIDE The comparison table FORENSIC IMAGE LOGICAL EXTRACTION TARGETED COLLECTION § 0 5 · FIT Matching method to evidential need § 0 6 · THEMONEY Cost and proportionality: the chain consequences § 0 7 · THEDECISION The decision tree § 0 8 · HONESTLEDGER The honest risk register of each method Forensic image § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEHYBRIDTHATFITTEDTHECASE EXAMPLE2 · THEBLANKETINSTRUCTION EXAMPLE3 · THETRIGGERTHATFIRED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTION PA R AG RAPH ( METHODPERSOURCEWITH TRIGGERS ) SUGGESTEDWORDING · DRD / CORRESPONDENCE PA R AG RAPHEXPLAININGAMIXED APPR OAC H § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The method-selection checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is targeted collection defensible, or will we be criticised for not imaging? Can we start light and upgrade to imaging later if needed? Do we need to image every custodian's laptop? How do phones fit this framework? Roughly what does each method cost? What should we do when the other side chose the wrong method for a contested source? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY