Page 1
REMOTECOLLECTION · A GUIDE FOR UK LAWYERS Remote Forensic Collection: When Can It Be Defensible? Secure Agents, Remote Access and the Disciplines That Replace Physical Presence COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the examiner is not in the room 03 The remote-collection models 04 What makes remote defensible: the five disciplines 05 Bandwidth, interruption and the physics of distance 06 The custodian problem: cooperation, interference and supervision 07 Security, privacy and cross-border considerations 08 When attendance still wins 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: DEFENSIBILITYFOLLOWSMETHOD, NOTGEOGRAPHY
§ 02 · FIRST PRINCIPLES The problem in plain English: the examiner is not in the room
§ 03 · THE MODEL S The remote-collection models MODEL HOW IT WORKS STRENGTH AND PROPER DOMAIN
Page 2
§ 04 · THEDISCIPLINES What makes remote defensible: the five disciplines 1 · Endpoint verification: the agent or session records what machine this actually is: hard w are serials, disk • 2 · Hash at source, verify on receipt: values computed on the end point before transmission, recomputed at • 3 · Encrypted, authenticated transport: the channel (agent tunnel, VPN, secure transfer platform) encrypts in • 4 · Complete session logging: everything the remote process did, timestamped: deployment, commands, •
§ 05 · PHYSICS Bandwidth, interruption and the physics of distance
§ 06 · THEHUMANENDPOINT The custodian problem: cooperation, interference and supervision
§ 07 · BORDERSANDDUTIES Security, privacy and cross-border considerations
§ 08 · THERESIDUALCASEFORTHEFLIGHT When attendance still wins
§ 09 · IN THE WILD Worked examples EXAMPLE1 · TWELVECUSTODIANS, FOURCOUNTRIES, ONEWEEK EXAMPLE2 · THESELF - COLLECTIONKITANDTHEACCUSEDCUSTODIAN EXAMPLE3 · THEINTERRUPTEDIMAGETHATSURVIVEDBECAUSETHELOGDID
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · REMOTEANNEXFORTHECOLLECTIONPROTOCOL SUGGESTED WORDING · CUSTODIANPRE - SESSIONINSTRUCTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The remote-collection checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is remotely collected evidence weaker in court than evidence collected in person? Can a custodian defeat a remote collection? How long does remote collection take? Do we need the custodian's consent to deploy an agent to a company laptop? What happens if the connection dies halfway through? Can search orders or imaging orders be executed remotely?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Remote Forensic Collection When Can It Be Defensible, Computer Forensics Lab, https://e-discovery.uk/library/remote-forensic-collection-when-can-it-be-defensible/pdf.