Page 1

REMOTECOLLECTION · A GUIDE FOR UK LAWYERS Remote Employee Collection Preserving and Collecting Evidence From Devices You Cannot Put Your Hands COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM SUPERVISED SELF-COLLECTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the evidence is on a device you cannot reach 03 The methods: agents, cloud-side, supervised self-collection and shipped media 04 Choosing the method: cooperation, completeness, control and risk 05 Preserving a device you cannot touch 06 Defensibility: chain of custody, verification and the reluctant custodian 07 Data protection, privacy and personal devices 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: REMOTECOLLECTIONISTHEORDINARYCASENOW, ANDITIS DEFENSIBLEWHENTHEMETHODISMATCHEDTOTHECUSTODIAN ' SCOOPERATIONAND SHIPPEDMEDIA, EACHDOCUMENTED, VERIFIEDANDDATA - MINIMISED, WITHTHE DEVICEPRESERVEDTHEMOMENTTHEDUTYARISES

§ 02 · FIRST PRINCIPLES The problem in plain English: the evidence is on a device you cannot reach

§ 03 · THE METHOD S The methods: agents, cloud-side, supervised self-collection and shipped media