Page 1
LOCKEDMOBILEDEVICES · A GUIDE FOR UK LAWYERS Locked Mobile Devices Preservation, Access Routes, Legal Authority and the Decisions That Must Be Made Before Anyone Tries the Passcode COMPUTER FORENSICS LAB DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES LOCKED-DEVICE ASSESSMENT LAWFUL ACCESS & ENSEMBLE STRATEGY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the wall that is some time s a door 03 First decisions: state, custody and the things nobody must do 04 The access routes, ranked by realism 05 Legal authority: consent, contract, compulsion and s.49 RIPA 06 Risk management: attempts, biometrics, lockouts and wipes 07 Strategy: the parallel-tracks framework 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ALOCKEDDEVICEISASTRATEGYPROBLEMWITHATECHNICAL COMPONENT, ANDTHESTRATEGYHASPARALLELTRACKS
§ 02 · FIRST PRINCIPLES The problem in plain English: the wall that is some time s a door
§ 03 · HOURONE First decisions: state, custody and the things nobody must do
Page 2
§ 04 · THEROUTES The access routes, ranked by realism ROUTE REALISM · WHAT GOVERNS IT
§ 05 · AUTHORITY Legal authority: consent, contract, compulsion and s.49 RIPA
§ 06 · NOTBREAKINGIT Risk management: attempts, biometrics, lockouts and wipes
§ 07 · THEPLAN Strategy: the parallel-tracks framework
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE LOCKED HANDSET CLOUD COMPUTER PAIRED COUNTERPARTS / DELETED / (IF ACCOUNT BACKUPS COMPUTERS PROVIDERS RECOVERABLE OPENED)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECLAUSETHATOPENEDTHEPHONE EXAMPLE2 · THEBFUWALLANDTHEENSEMBLETHATWENTROUNDIT EXAMPLE3 · THEREFUSALTHATTESTIFIED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The locked-device checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a court really order someone to hand over their passcode? How long should we keep a device we cannot currently open? Is it worth paying for exotic unlocking services? The custodian offers to unlock it himself and show us the messages. Acceptable? What if the device wipes itself during exam in at i on? Does a factory-reset device end the inquiry?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Locked Mobile Devices, Computer Forensics Lab, https://e-discovery.uk/library/locked-mobile-devices/pdf.