Page 1

COLLECTION METHOD S · A GUIDE FOR UK LAWYERS Forensic Image, Logical Extraction or Targeted Collection? Choosing the Right Depth of Acquisition, Source by Source COMPUTER FORENSICS LAB · E-DISCOVERY. UK

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: a false binary 03 The three methods, properly defined 04 The comparison table 05 Matching method to evidential need 06 Cost and proportionality: the chain consequences 07 The decision tree 08 The honest risk register of each method 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DEPTHISCHOSENPERSOURCE, ANDTHEOPTIONTOGODEEPER ISPRESERVED

§ 02 · FIRST PRINCIPLES The problem in plain English: a false binary

§ 03 · TERMSOFART The three methods, properly defined Forensic (physical) image Logical extraction Targeted collection