Page 1

ON - SITE COLLECTION · A GUIDE FOR UK LAWYERS Planning an On-Site Digital Evidence Collection Access, Equipment, Credentials, Disruption and the Day That Goes to Plan COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES ON-SITE & LABORATORY ACQUISITION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: why site days go wrong 03 The pre-visit reconnaissance 04 Access, authority and the people question 05 Credentials, encryption and the keys to the estate 06 Equipment: what the kit list actually contains 07 The day itself: sequence, disruption and logging 08 Departure: sealing, transport and the site left behind 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THESITEVISITISWONINTHEWEEKBEFOREIT

§ 02 · FIRST PRINCIPLES The problem in plain English: why site days go wrong

§ 03 · THEWEEKBEFORE The pre-visit reconnaissance