Native Documents PDFs Or Images Which Production Format

PRODUCTIONFORMATS · AGUIDEFORUKLAWYERS Native Documents, PDFs or Images: Which Production Format? What Each Format Preserves, What Each Destroys, and How to Choose in the Protocol COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the format is an evidence decision 03 The three families: native, searchable PDF and image-plus-load-file 04 Document classes that force the choice: spreadsheets, presentations, chat and media 05 The rules layer: PD 57AD, PD 31B and what "native" means in an order 06 Redaction, confidentiality and the imaging exception 07 Receiving productions: acceptance checks and challenge routes 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PRODUCENATIVEBYDEFAULT , IMAGEONLYFORCAUSE , AND PRESERVETHEROUTEBACKTOTHENATIVEFOREVERYDOCUMENTTHATMATTERS 87 §7's warning. Image-plus-load-file (TIFF/PDF images with extracted text and agreed metadata fields) § 0 2 · FIRSTPRINCIPLES The problem in plain English: the format is an evidence decision § 0 3 · THEFAMILIES The three families: native, searchable PDF and image-plus-load- file § 0 4 · THEFORCINGCLASSES Document classes that force the choice: spreadsheets, presentations, chat and media § 0 5 · THERULESLAYER The rules layer: PD 57AD, PD 31B and what "native" means in an order § 0 6 · THEIMAGINGEXCEPTION Redaction, confidentiality and the imaging exception § 0 7 · RECEIVINGEND Receiving productions: acceptance checks and challenge routes § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives WHAT THE YOUR DMS / UPSTREAM PRODUCTION COUNTERPART CLOUD STRUCTURED STRIPPED COPIES PLATFORMS SOURCES PRODUCER'S TRANSMISSION DEVICE NATIVES RECORD LAYER § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEMODELPRODUCEDAS4 , 100PAGES EXAMPLE2 · THE " NATIVE " ORDERANSWEREDWITHCONVERSIONS EXAMPLE3 · THEIMAGINGTHATWASEXACTLYRIGHT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · FORM AT PA R AG RAPHFORTHEDISCLOSUREPROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The format checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is there a single best production format? The other side wants everything as PDFs "for convenience". Should we agree? How do we cite a native spreadsheet in a bundle or judgment? We received images and the text layer seems poor. Whose problem is that? Do we have to produce hidden sheets, tracked changes and speaker notes? The producing party says the native no longer exists. Now what? § 1 4 · REFERENCE Glossary Sources and authoritative references 35 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY