Page 1
CLOUD DOCUMENT VERSION S · A GUIDE FOR UK LAWYERS Recovering Previous Versions of Cloud Documents The Drafting History Share Point, One Drive and Google Drive Keep Without Being Asked COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES VERSION-HISTORY COLLECTION AUTHORSHIP & CHRONOLOGY ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the file is a frame, the history is the film 03 How platforms keep versions: Share Point, One Drive, Google Drive and DMS systems 04 What kills history: limits, retention, copies, moves and migrations 05 Preserving and collecting versions forensic all y 06 Reading the ladder: authorship, chronology and the shape of drafting 07 Versions in dispute: authenticity, disclosure scope and production 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CLOUD PLATFORM S KEEP A DOCUMENT ' SVERSIONLADDER AUTOMATICALLY, ATTRIBUTEDANDTIMESTAMPED: PRESERVEITBEFORELIMITSAND RETENTIONPRUNEIT, COLLECTITWITHTHEHISTORYINTACT, ANDREADITASTHE DRAFTINGRECORDITIS
§ 02 · FIRST PRINCIPLES The problem in plain English: the file is a frame, the history is the film
§ 03 · HOWVERSIONSAREKEPT How platforms keep versions: Share Point, One Drive, Google Drive and DMS systems
Page 2
§ 04 · WHATKILLSHISTORY What kills history: limits, retention, copies, moves and migrations
§ 05 · PRESERVATION AND COLLECTION Preserving and collecting versions forensic all y
§ 06 · READINGTHELADDER Reading the ladder: authorship, chronology and the shape of drafting
§ 07 · VERSION S IN DISPUTE Versions in dispute: authenticity, disclosure scope and production
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE VERSION DOCUMENT PLATFORM INTERNAL LADDER METADATA AUDIT ATTACHMENT S / CACHES + PLATFORM LOGS SENT COPIES LOCAL BACKUPS END POINT COPIES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEINDEMNITYTHATLEFTAT23: 4 EXAMPLE2 · THEMIGRATIONTHATFLATTENEDTHELADDER, AND THE BACKUP THAT DID NOT EXAMPLE3 · THEEXPORTTHATFORGOTTHEVERSIONS
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The version-history checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Are prior versions really "documents" we have to disclose? The version history on our key document is missing. Does that look bad? Can the platform tell us who made a specific change? We only have the document as an email attachment. Is that enough? How far back do version histories go? Do drafts carry privilege the final does not?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Recovering Previous Versions Of Cloud Documents, Computer Forensics Lab, https://e-discovery.uk/library/recovering-previous-versions-of-cloud-documents/pdf.