Page 1
COLLECTION PROTOCOL S · A GUIDE FOR UK LAWYERS Preparing a Forensic Collection Protocol The Written Plan That Makes a Collection Defensible Before It Begins COMPUTER FORENSICS LAB DISCOVERY. UK
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ACPO / NPCC DIGITAL EVIDENCE PRINCIPLES PROTOCOL DRAFTING & EXECUTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: collections without plans 03 What a protocol is, and when one is needed 04 The anatomy: section by section 05 Scope: custodians, sources, date ranges, method per source 06 Exclusions, privilege and personal data 07 Execution: sequence, roles, verification and custody 08 Contingencies and escalation triggers 09 Agreed and court-ordered protocols 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WRITETHECOLLECTIONDOWNBEFOREITHAPPENS
§ 02 · FIRST PRINCIPLES The problem in plain English: collections without plans
§ 03 · DEFINITION What a protocol is, and when one is needed
Page 2
§ 04 · THESKELETON The anatomy: section by section SECTION CONTENTS 1 · Purpose and authority The matter, the legal basis (instruction, order, consent), the protocol's status and version, 2 · Scope Custodians (Schedule A), sources (Schedule B), date ranges, data types in and out 4 · Exclusions and privilege What is not collected; how privileged and personal material encountered is handled; review 5 · Execution plan Sequence, sites, dates, roles (examiner, IT, supervising lawyer), powered-on device 6 · Verification and custody Hashing standards, acquisition records, exhibit referencing, sealing, storage and transfer 7 · Contingencies Encryption without credentials, absent or failed devices, unexpected sources, refusals, 8 · Escalation triggers Discoveries that pause execution and refer back: suspected deletion, contested material, 9 · Deliverables and What the exercise produces: evidence schedule, hash schedule, deviation log, collection 10 · Amendment How the protocol changes: written variation, logged, approved by the named owners
§ 05 · SCOPE Scope: custodians, sources, date ranges, method per source
§ 06 · THESENSITIVEMATERIAL Exclusions, privilege and personal data
§ 07 · EXECUTION Execution: sequence, roles, verification and custody
§ 08 · WHENREALITYINTERVENES Contingencies and escalation triggers
§ 09 · TWO - PARTY PROTOCOL S Agreed and court-ordered protocols
Page 3
§ 10 · IN THE WILD Worked examples EXAMPLE1 · THECORRIDORDECISION EXAMPLE2 · THEPROTOCOLANNEXEDTOTHEORDER EXAMPLE3 · THEHYBRIDTHATSTAYEDDEFENSIBLE
§ 11 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 12 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · PROTOCOLCORECLAUSES ( A DA PT ) SUGGESTED WORDING · C OV ERLETTERE XC HANGINGTHEPROTOCOL
§ 13 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The protocol checklist Red flags When to involve a digital forensic expert
§ 14 · COMMON QUESTIONS Frequently asked questions Is a protocol really necessary for a small, single-device matter? Should we show our collection protocol to the other side? What is the difference between the collection protocol and the DRD's methodology sections? Can the client's IT team execute parts of the protocol to save cost? What happens when execution has to depart from the protocol? Who signs off the protocol, and does the client need to?
§ 15 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Preparing A Forensic Collection Protocol, Computer Forensics Lab, https://e-discovery.uk/library/preparing-a-forensic-collection-protocol/pdf.