§ CONTENTS
In this guide
01 Executive summary
02 The problem in plain English: the format is an evidence decision
03 The three families: native, searchable PDF and image-plus-load-file
04 Document classes that force the choice: spreadsheets, presentations, chat and media
05 The rules layer: PD 57AD, PD 31B and what "native" means in an order
06 Redaction, confidential it y and the imaging exception
07 Receiving productions: acceptance checks and challenge routes
08 Source architecture: where else the evidence lives
09 Worked examples
10 Common mistakes and technical limitations
11 Questions to ask · Suggested wording
12 Checklist and red flags · When to involve a digital forensic expert
13 Frequently asked questions
14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION
Executive summary
THE HEADLINE POINT: PRODUCENATIVEBYDEFAULT, IMAGE ONLY FOR CA USE, AND
PRESERVETHEROUTEBACKTOTHENATIVEFOREVERYDOCUMENTTHATMATTERS
87
§ 7's warning. Image-plus-load-file (TIFF/PDF images with extracted text and agreed metadata fields)
§ 02 · FIRST PRINCIPLES
The problem in plain English: the format is an evidence decision
§ 03 · THEFAMILIES
The three families: native, searchable PDF and image-plus-loadfile
§ 04 · THEFORCINGCLASSES
Document classes that force the choice: spreadsheets,
presentations, chat and media
§ 05 · THERULESLAYER
The rules layer: PD 57AD, PD 31B and what "native" means in an
order
§ 06 · THEIMAGINGEXCEPTION
Redaction, confidential it y and the imaging exception
§ 07 · RECEIVINGEND
Receiving productions: acceptance checks and challenge routes
§ 08 · THEWIDERMAP
Source architecture: where else the evidence lives
WHAT THE YOUR DMS / UPSTREAM
PRODUCTION COUNTERPART CLOUD STRUCTURED
STRIPPED COPIES PLATFORMS SOURCES
PRODUCER'S TRANSMISSION DEVICE
NATIVES RECORD LAYER
§ 09 · IN THE WILD
Worked examples
EXAMPLE1 · THE MODEL PRODUCED AS4, 100PAGES
EXAMPLE2 · THE " NATIVE " ORDERANSWEREDWITHCONVERSIONS
EXAMPLE3 · THEIMAGINGTHATWASEXACTLYRIGHT
§ 10 · WHEREITGOESWRONG
Common mistakes and technical limitations
Common mistakes
Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS
Questions to ask · Suggested wording
Ask your client
Ask your opponent
Ask your e Discovery / forensic provider
SUGGESTED WORDING · FORM AT PA R AG RAPHFORTHEDISCLOSUREPROTOCOL
§ 12 · QUICK CONTROL
Checklist and red flags · When to involve a digital forensic
expert
The format checklist
Red flags
When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS
Frequently asked questions
Is there a single best production format? The other side wants everything as PDFs "for convenience". Should we agree? How do we cite a native spreadsheet in a bundle or judgment? We received images and the text layer seems poor. Whose problem is that? Do we have to produce hidden sheets, tracked changes and speaker notes? The producing party says the native no longer exists. Now what?
§ 14 · REFERENCE
Glossary
Sources and authoritative references
35 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides
DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST
Working with Computer Forensics Lab
Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB
NEWENQUIRIESEMAILE - DISCOVERY