Page 1
SHARE POINT EVIDENCE · A GUIDE FOR UK LAWYERS Share Point as a Disclosure Source Libraries, Versions, Permissions and Deleted Sites: the Shared Estate and Its Collaborative Metadata COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM PERMISSION & ACCESS ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the file server that got a memory 03 Site anatomy: libraries, lists, pages and their records 04 Versions and collaborative metadata 05 Permissions, inheritance and the possibility map 06 Deletion at every scale: files, libraries, sites 07 Collection: keeping the shapes that matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: GUIDE43 ' STHREELAYERS, WITHBETTERRECORDSANDNEW WAYSTOLOSETHEM
§ 02 · FIRST PRINCIPLES The problem in plain English: the file server that got a memory
§ 03 · THEESTATE Site anatomy: libraries, lists, pages and their records
Page 2
§ 04 · THEDRAFTINGRECORD Versions and collaborative metadata
§ 05 · WHO COULD Permissions, inheritance and the possibility map
§ 06 · GONE, ATWHATSCALE Deletion at every scale: files, libraries, sites
§ 07 · GETTINGTHESHAPESOUT Collection: keeping the shapes that matter
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYNCED SITE (CONTENT + TEAMS / EMAIL AUDIT + BACKUP DELETED / VERSIONS + COUNTERPARTS DIRECTORY LAYER RECOVERABLE RECYCLE) MEMBERS' DEVICES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEINHERITANCEBREAKNOBODYDECLARED EXAMPLE2 · THEVANISHEDPROJECTSITE, THREERESTORESDEEP EXAMPLE3 · THEMIGRATIONTHATLOOKEDLIKEBACKDATING
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · SHAREPOINTLIMBFORTHECOLLECTIONSPECIFIC AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Share Point checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Do we really need version histories for every document? Can we find out who accessed a confidential folder, and when? A whole site has been deleted. What is the realistic sequence? The other side says a permission change was "routine housekeeping". How is that tested? How does Teams complicate the Share Point picture? What single export should a c company every Share Point dispute?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 with windows and grains stated; through e-discovery.uk, site collections land in review structured, Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, SharePoint As A Disclosure Source, Computer Forensics Lab, https://e-discovery.uk/library/sharepoint-as-a-disclosure-source/pdf.