SharePoint As A Disclosure Source

SHAREPOINTEVIDENCE · AGUIDEFORUKLAWYERS SharePoint as a Disclosure Source Libraries, Versions, Permissions and Deleted Sites: the Shared Estate and Its Collaborative Metadata COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM PERMISSION & ACCESS ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the file server that got a memory 03 Site anatomy: libraries, lists, pages and their records 04 Versions and collaborative metadata 05 Permissions, inheritance and the possibility map 06 Deletion at every scale: files, libraries, sites 07 Collection: keeping the shapes that matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : GUIDE43 ' STHREELAYERS , WITHBETTERRECORDSANDNEW WAYSTOLOSETHEM § 0 2 · FIRSTPRINCIPLES The problem in plain English: the file server that got a memory § 0 3 · THEESTATE Site anatomy: libraries, lists, pages and their records § 0 4 · THEDRAFTINGRECORD Versions and collaborative metadata § 0 5 · WHOCOULD Permissions, inheritance and the possibility map § 0 6 · GONE , ATWHATSCALE Deletion at every scale: files, libraries, sites § 0 7 · GETTINGTHESHAPESOUT Collection: keeping the shapes that matter § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYNCED SITE (CONTENT + TEAMS / EMAIL AUDIT + BACKUP DELETED / VERSIONS + COUNTERPARTS DIRECTORY LAYER RECOVERABLE RECYCLE) MEMBERS' DEVICES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEINHERITANCEBREAKNOBODYDECLARED EXAMPLE2 · THEVANISHEDPROJECTSITE , THREERESTORESDEEP EXAMPLE3 · THEMIGRATIONTHATLOOKEDLIKEBACKDATING § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · SHAREPOINTLIMBFORTHECOLLECTIONSPECIFIC AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The SharePoint checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Do we really need version histories for every document? Can we find out who accessed a confidential folder, and when? A whole site has been deleted. What is the realistic sequence? The other side says a permission change was "routine housekeeping". How is that tested? How does Teams complicate the SharePoint picture? What single export should accompany every SharePoint dispute? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab 35 with windows and grains stated; through e-discovery.uk , site collections land in review structured, Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY