Page 1

SHARE POINT EVIDENCE · A GUIDE FOR UK LAWYERS Share Point as a Disclosure Source Libraries, Versions, Permissions and Deleted Sites: the Shared Estate and Its Collaborative Metadata COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM PERMISSION & ACCESS ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the file server that got a memory 03 Site anatomy: libraries, lists, pages and their records 04 Versions and collaborative metadata 05 Permissions, inheritance and the possibility map 06 Deletion at every scale: files, libraries, sites 07 Collection: keeping the shapes that matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: GUIDE43 ' STHREELAYERS, WITHBETTERRECORDSANDNEW WAYSTOLOSETHEM

§ 02 · FIRST PRINCIPLES The problem in plain English: the file server that got a memory

§ 03 · THEESTATE Site anatomy: libraries, lists, pages and their records