Page 1
PERSONALEMAILACCOUNTS · A GUIDE FOR UK LAWYERS Personal Email Accounts in Disclosure Gmail, Hotmail and the Business That Left the Building COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES WEBMAIL & PERSONAL-ACCOUNT COLLECTION SELF-COLLECTION VERIFICATION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the account the company cannot open 03 Control and disclosability of personal accounts 04 Collection routes: from self-collection to examiner protocols 05 Verifying completeness: the forensic periphery 06 Deliberate off-books channels: conduct and consequences 07 Privacy, mixed content and the account holder's rights 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THEBUSINESSCONTENTOFAPERSONALACCOUNTISUSUALLY DISCLOSABLE, THEACCOUNTHOLDERUSUALLYCOLLECTSIT, AND THE FORENSIC PERIPHERYCHECKSTHEIRWORK
§ 02 · FIRST PRINCIPLES The problem in plain English: the account the company cannot open
§ 03 · THEDUTY Control and disclosability of personal accounts
Page 2
§ 04 · THEROUTES Collection routes: from self-collection to examiner protocols
§ 05 · CHECKINGTHEWORK Verifying completeness: the forensic periphery
§ 06 · OFFTHEBOOKS Deliberate off-books channels: conduct and consequences
§ 07 · RIGHTS Privacy, mixed content and the account holder's rights
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE ARCHIVE CLIENTS & FORWARDING WEBMAIL ACCOUNT COUNTERPART DELETED / (HOLDER- MAILBOXES RECOVERABLE MEDIATED) PROVIDER DEVICE CORPORATE EXPORT CACHES TRAIL
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEAUTO - FORWARDTHATINDEXEDITSELF EXAMPLE2 · THESELF - COLLECTIONTHESENTFOLDERBETRAYED EXAMPLE3 · THELEGACYYAHOOTHATPREDATEDTHECOMPANY
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · PERSONAL- AC COUNTLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The personal-account checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can we force an opponent to disclose their Gmail? Our custodian says the relevant messages were deleted years ago. Dead end? Is self-collection ever defensible for important custodians? The personal account also holds the custodian's own privileged and intimate material. How is that handled? We found business being run through a personal account deliberately. What do we do with that? Do we need to worry about our own client's personal accounts?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Personal Email Accounts In Disclosure, Computer Forensics Lab, https://e-discovery.uk/library/personal-email-accounts-in-disclosure/pdf.