OSINT Open Source Intelligence In Litigation

OPEN - SOURCEINTELLIGENCE · AGUIDEFORUKLAWYERS OSINT: Open-Source Intelligence in Litigation Public Data, Lawful Method and Evidence That Holds Up COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: public does not mean proven 03 What OSINT covers: the open sources 04 Capturing and preserving so it can be authenticated 05 Verification, corroboration and attribution 06 Legal and ethical limits 07 Deployment: asset tracing, due diligence and fact-testing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary OSINT is only useful when the material is captured and preserved so it can be authenticated, gathered lawfully and proportionately, and verified rather than assumed, turning information into evidence that holds up. § 0 2 · FIRSTPRINCIPLES The problem in plain English: public does not mean proven § 0 3 · THEOPENSOURCES What OSINT covers: the open sources SOCIAL / WEB COMPANY PROPERTY REGISTERS DOMAIN / WEB § 0 4 · CAPTUREANDPRESERVATION Capturing and preserving so it can be authenticated § 0 5 · VERIFICATIONANDATTRIBUTION Verification, corroboration and attribution § 0 6 · LEGALANDETHICALLIMITS Legal and ethical limits § 0 7 · DEPLOYMENT Deployment: asset tracing, due diligence and fact-testing § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE OPEN REGISTRAR SHARED ACCOUNT LIVE PLATFORM / OTHERS' DEVICE / SOURCE RECORDS COPIES FORENSICS WEB DELETED / ARCHIVES SUPERSEDED § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEHOLIDAYPHOTOSTHATANSWEREDTHEINJURYCLAIM EXAMPLE2 · THEHIDDENNETWORKBEHINDTHECOMPANY EXAMPLE3 · THEFAKESCREENSHOTANDTHECLEANMETHOD § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (where relevant) Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORANOSINTG AT HERINGANDANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The OSINT checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions If information is public, can we just use it? Why is a screenshot not good enough? Can we set up a fake profile to see a private account? How do we know a social-media account belongs to the person? Can OSINT expose fabricated evidence? Is OSINT a substitute for disclosure and forensics? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY