Recovering Previous Versions Of Cloud Documents

CLOUDDOCUMENTVERSIONS · AGUIDEFORUKLAWYERS Recovering Previous Versions of Cloud Documents The Drafting History SharePoint, OneDrive and Google Drive Keep Without Being Asked COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES VERSION-HISTORY COLLECTION AUTHORSHIP & CHRONOLOGY ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the file is a frame, the history is the film 03 How platforms keep versions: SharePoint, OneDrive, Google Drive and DMS systems 04 What kills history: limits, retention, copies, moves and migrations 05 Preserving and collecting versions forensically 06 Reading the ladder: authorship, chronology and the shape of drafting 07 Versions in dispute: authenticity, disclosure scope and production 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CLOUDPLATFORMSKEEPADOCUMENT ' SVERSIONLADDER AUTOMATICALLY , ATTRIBUTEDANDTIMESTAMPED : PRESERVEITBEFORELIMITSAND RETENTIONPRUNEIT , COLLECTITWITHTHEHISTORYINTACT , ANDREADITASTHE DRAFTINGRECORDITIS § 0 2 · FIRSTPRINCIPLES The problem in plain English: the file is a frame, the history is the film § 0 3 · HOWVERSIONSAREKEPT How platforms keep versions: SharePoint, OneDrive, Google Drive and DMS systems § 0 4 · WHATKILLSHISTORY What kills history: limits, retention, copies, moves and migrations § 0 5 · PRESERVATIONANDCOLLECTION Preserving and collecting versions forensically § 0 6 · READINGTHELADDER Reading the ladder: authorship, chronology and the shape of drafting § 0 7 · VERSIONSINDISPUTE Versions in dispute: authenticity, disclosure scope and production § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE VERSION DOCUMENT PLATFORM INTERNAL LADDER METADATA AUDIT ATTACHMENTS / CACHES + PLATFORM LOGS SENT COPIES LOCAL BACKUPS ENDPOINT COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEINDEMNITYTHATLEFTAT23 : 4 EXAMPLE2 · THEMIGRATIONTHATFLATTENEDTHELADDER , ANDTHEBACKUPTHATDID NOT EXAMPLE3 · THEEXPORTTHATFORGOTTHEVERSIONS § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The version-history checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Are prior versions really "documents" we have to disclose? The version history on our key document is missing. Does that look bad? Can the platform tell us who made a specific change? We only have the document as an email attachment. Is that enough? How far back do version histories go? Do drafts carry privilege the final does not? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY