GitHub GitLab And Source Code As Evidence
SOURCECODEEVIDENCE · A GUIDE FOR UK LAWYERS GitHub, GitLab and Source Code as Evidence Commits, Clones and the Development History That Dates Every Line COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the manuscript that dates itself 03 Git anatomy: commits, branches, hashes and what they prove 04 Platform evidence: pull requests, reviews, issues and logs 05 Authenticating history: forged dates and rewritten pasts 06 Exfiltration: clones, forks and the departing developer 07 Copying disputes: similarity analysis and provenance 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: GITDATESEVERYLINEANDNAMESEVERYAUTHOR, BUTBOTH FIELDS ARE SET TABLE: PLATFORM - SIDERECORDSARETHEANCHORTHATMAKES REPOSITORYHISTORYTRUSTWORTHY
§ 02 · FIRST PRINCIPLES The problem in plain English: the manuscript that dates itself
§ 03 · THEREPOSITORY Git anatomy: commits, branches, hashes and what they prove
§ 04 · THEPLATFORMLAYER Platform evidence: pull requests, reviews, issues and logs
§ 05 · TRUST, VERIFIED Authenticating history: forged dates and rewritten pasts
§ 06 · TAKEN Exfiltration: clones, forks and the departing developer
§ 07 · COPIED Copying disputes: similarity analysis and provenance
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE CLONES / OLD PLATFORM CI/CD & REGISTRIES & DELETED / REPO DEPLOYS ARTEFACTS RECOVERABLE LOCAL BACKUPS / FORKS DEVICES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECOMMITFROMTHEFUTURE ' SPAST EXAMPLE2 · THETOKENTHATOUTLIVEDTHEJOB EXAMPLE3 · THETYPOTHATTRAVELLED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SOURCE - CODELIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The source-code checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can git really prove when code was written? A developer says someone else committed under their name. Possible? The opponent deleted the repository. Is the history gone? How much code similarity is enough to prove copying? Our code is commercially sensitive. Must we hand it to the opponent to fight a copying case? Does AI-generated code change any of this?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, GitHub GitLab And Source Code As Evidence, Computer Forensics Lab, https://e-discovery.uk/library/github-gitlab-and-source-code-as-evidence/pdf.