Page 1
REMOTECOLLECTION · A GUIDE FOR UK LAWYERS Remote Employee Collection Preserving and Collecting Evidence From Devices You Cannot Put Your Hands COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM SUPERVISED SELF-COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is on a device you cannot reach 03 The methods: agents, cloud-side, supervised self-collection and shipped media 04 Choosing the method: cooperation, completeness, control and risk 05 Preserving a device you cannot touch 06 Defensibility: chain of custody, verification and the reluctant custodian 07 Data protection, privacy and personal devices 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: REMOTECOLLECTIONISTHEORDINARYCASENOW, ANDITIS DEFENSIBLEWHENTHEMETHODISMATCHEDTOTHECUSTODIAN ' SCOOPERATIONAND SHIPPEDMEDIA, EACHDOCUMENTED, VERIFIEDANDDATA - MINIMISED, WITHTHE DEVICEPRESERVEDTHEMOMENTTHEDUTYARISES
§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is on a device you cannot reach
§ 03 · THE METHOD S The methods: agents, cloud-side, supervised self-collection and shipped media
Page 2
§ 04 · CHOOSINGTHEMETHOD Choosing the method: cooperation, completeness, control and risk
§ 05 · PRESERVINGADEVICEYOUCANNOTTOUCH Preserving a device you cannot touch
§ 06 · DEFENSIBILITY Defensibility: chain of custody, verification and the reluctant custodian
§ 07 · DATAPROTECTIONANDPRIVACY Data protection, privacy and personal devices
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION REMOTE + CLOUD CLOUD MANAGEMENT COUNTERPARTIES LOCAL THE MAILBOX SA AS + DEVICE- DELETED / DEVICE DRIVES INFRA PLATFORM ONLY
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THECOOPERATIVECUSTODIANANDTHESEQUENCEDCOLLECTION EXAMPLE2 · THEADVERSECUSTODIANWHOWASNEVERALLOWEDTOSELF - COLLECT EXAMPLE3 · THEPERSONALDEVICEANDTHEINDEPENDENTEXAMINER
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent (or a reluctant custodian) Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAREMOTECOLLECTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The remote-collection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can a device be collected forensic all y without anyone touching it? Can we just ask the employee to send us the relevant files? The custodian works from home abroad. Does that change things? How do we collect from a personal device without invading privacy? Is a remote collection as defensible as a bench image? What do we do the moment we know a remote custodian is relevant?
§ 14 · REFERENCE Glossary BYOD Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Remote Employee Collection, Computer Forensics Lab, https://e-discovery.uk/library/remote-employee-collection/pdf.