Page 1
ON - SITE COLLECTION · A GUIDE FOR UK LAWYERS Planning an On-Site Digital Evidence Collection Access, Equipment, Credentials, Disruption and the Day That Goes to Plan COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES ON-SITE & LABORATORY ACQUISITION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: why site days go wrong 03 The pre-visit reconnaissance 04 Access, authority and the people question 05 Credentials, encryption and the keys to the estate 06 Equipment: what the kit list actually contains 07 The day itself: sequence, disruption and logging 08 Departure: sealing, transport and the site left behind 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THESITEVISITISWONINTHEWEEKBEFOREIT
§ 02 · FIRST PRINCIPLES The problem in plain English: why site days go wrong
§ 03 · THEWEEKBEFORE The pre-visit reconnaissance
Page 2
§ 04 · DOORSANDPEOPLE Access, authority and the people question
§ 05 · KEYS Credentials, encryption and the keys to the estate
§ 06 · THEVAN Equipment: what the kit list actually contains
§ 07 · EXECUTION The day itself: sequence, disruption and logging
§ 08 · LEAVINGWELL Departure: sealing, transport and the site left behind
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEQUESTIONNAIRETHATFOUNDTHESECONDSERVERROOM EXAMPLE2 · THEQUARTER - ENDCOLLISIONTHATPLANNINGDISSOLVED EXAMPLE3 · THEKITLISTVERSUSTHE2011RAID
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (for agreed or supervised visits) Ask your e Discovery / forensic provider SUGGESTED WORDING · CLIENT SITE - PREPARATION INSTRUCTION SUGGESTED WORDING · DAY- PLANHEADER ( THEONE - PAGE VERSION THE TEAM CARRIES )
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The on-site planning checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions How long does an on-site collection take? Can the business keep working while we collect? Should devices be imaged on site or taken to the laboratory? What if we find devices on site that are not on the schedule? Do we need to tell staff what is happening? What does the client get after the visit?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Planning An On Site Digital Evidence Collection, Computer Forensics Lab, https://e-discovery.uk/library/planning-an-on-site-digital-evidence-collection/pdf.