GitHub GitLab And Source Code As Evidence

SOURCECODEEVIDENCE · AGUIDEFORUKLAWYERS GitHub, GitLab and Source Code as Evidence Commits, Clones and the Development History That Dates Every Line COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the manuscript that dates itself 03 Git anatomy: commits, branches, hashes and what they prove 04 Platform evidence: pull requests, reviews, issues and logs 05 Authenticating history: forged dates and rewritten pasts 06 Exfiltration: clones, forks and the departing developer 07 Copying disputes: similarity analysis and provenance 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : GITDATESEVERYLINEANDNAMESEVERYAUTHOR , BUTBOTH FIELDSARESETTABLE : PLATFORM - SIDERECORDSARETHEANCHORTHATMAKES REPOSITORYHISTORYTRUSTWORTHY § 0 2 · FIRSTPRINCIPLES The problem in plain English: the manuscript that dates itself § 0 3 · THEREPOSITORY Git anatomy: commits, branches, hashes and what they prove § 0 4 · THEPLATFORMLAYER Platform evidence: pull requests, reviews, issues and logs § 0 5 · TRUST , VERIFIED Authenticating history: forged dates and rewritten pasts § 0 6 · TAKEN Exfiltration: clones, forks and the departing developer § 0 7 · COPIED Copying disputes: similarity analysis and provenance § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE CLONES / OLD PLATFORM CI/CD & REGISTRIES & DELETED / REPO DEPLOYS ARTEFACTS RECOVERABLE LOCAL BACKUPS / FORKS DEVICES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECOMMITFROMTHEFUTURE ' SPAST EXAMPLE2 · THETOKENTHATOUTLIVEDTHEJOB EXAMPLE3 · THETYPOTHATTRAVELLED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SOURCE - CODELIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The source-code checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can git really prove when code was written? A developer says someone else committed under their name. Possible? The opponent deleted the repository. Is the history gone? How much code similarity is enough to prove copying? Our code is commercially sensitive. Must we hand it to the opponent to fight a copying case? Does AI-generated code change any of this? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY