Page 1

LIVE & OFFLINEACQUISITION · A GUIDE FOR UK LAWYERS Should a Computer Be Imaged While Running or Switched Off? Volatile Data, Encryption and the Most Consequential Button in Forensics COMPUTER FORENSICS LAB E-DISCOVERY. UK

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the button and its consequences 03 Volatile data: what lives only in memory 04 Encryption changes everything: Bit Locker, File Vault and friends 05 Offline (dead-box) acquisition: strengths and risks 06 Live acquisition: strengths and risks 07 The at-the-machine decision framework 08 Servers, sleep states and special cases 09 Recording the decision: NPCC principle 2 in action 10 Worked examples 11 Common mistakes and technical limitations 12 Questions to ask · Suggested wording 13 Checklist and red flags · When to involve a digital forensic expert 14 Frequently asked questions 15 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ASSESSFIRST, CAPTURE MEMORY IF YOU CAN, ANDLET ENCRYPTIONDECIDETHEREST

§ 02 · FIRST PRINCIPLES The problem in plain English: the button and its consequences

§ 03 · WHATEVAPORATES Volatile data: what lives only in memory