Remote Forensic Collection When Can It Be Defensible

REMOTECOLLECTION · AGUIDEFORUKLAWYERS Remote Forensic Collection: When Can It Be Defensible? Secure Agents, Remote Access and the Disciplines That Replace Physical Presence COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the examiner is not in the room 03 The remote-collection models 04 What makes remote defensible: the five disciplines 05 Bandwidth, interruption and the physics of distance 06 The custodian problem: cooperation, interference and supervision 07 Security, privacy and cross-border considerations 08 When attendance still wins 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : DEFENSIBILITYFOLLOWSMETHOD , NOTGEOGRAPHY § 0 2 · FIRSTPRINCIPLES The problem in plain English: the examiner is not in the room § 0 3 · THEMODELS The remote-collection models MODEL HOW IT WORKS STRENGTH AND PROPER DOMAIN § 0 4 · THEDISCIPLINES What makes remote defensible: the five disciplines 1 · Endpoint verification: the agent or session records what machine this actually is: hardware serials, disk • 2 · Hash at source, verify on receipt: values computed on the endpoint before transmission, recomputed at • 3 · Encrypted, authenticated transport: the channel (agent tunnel, VPN, secure transfer platform) encrypts in • 4 · Complete session logging: everything the remote process did, timestamped: deployment, commands, • § 0 5 · PHYSICS Bandwidth, interruption and the physics of distance § 0 6 · THEHUMANENDPOINT The custodian problem: cooperation, interference and supervision § 0 7 · BORDERSANDDUTIES Security, privacy and cross-border considerations § 0 8 · THERESIDUALCASEFORTHEFLIGHT When attendance still wins § 0 9 · INTHEWILD Worked examples EXAMPLE1 · TWELVECUSTODIANS , FOURCOUNTRIES , ONEWEEK EXAMPLE2 · THESELF - COLLECTIONKITANDTHEACCUSEDCUSTODIAN EXAMPLE3 · THEINTERRUPTEDIMAGETHATSURVIVEDBECAUSETHELOGDID § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · REMOTEANNEXFORTHECOLLECTIONPROTOCOL SUGGESTEDWORDING · CUSTODIANPRE - SESSIONINSTRUCTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The remote-collection checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is remotely collected evidence weaker in court than evidence collected in person? Can a custodian defeat a remote collection? How long does remote collection take? Do we need the custodian's consent to deploy an agent to a company laptop? What happens if the connection dies halfway through? Can search orders or imaging orders be executed remotely? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY