Should Backup Systems Be Searched For Disclosure
BACKUP S IN DISCLOSURE · A GUIDE FOR UK LAWYERS Should Backup Systems Be Searched for Disclosure? Preservation, Proportionality and the Cases Where the Backup Is the Only Copy Left COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the archive every on e hopes to ignore 03 Preserve first, argue later: the legal baseline 04 Know what you actually have: backup technology in 05 When backups should be searched: the decision framework 06 Doing it well: targeted restoration methodology 07 Arguing the point: for access, and against it 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PRESERVATIONISNEAR - AUTOMATIC; SEARCH IN G IS A REASONED, EVIDENCEDCHOICE
§ 02 · FIRST PRINCIPLES The problem in plain English: the archive every on e hopes to ignore
§ 03 · THEBASELINE Preserve first, argue later: the legal baseline
§ 04 · KNOWYOURESTATE Know what you actually have: backup technology in GENERATION WHAT IT LOOKS LIKE, AND WHAT RESTORATION REALLY COSTS
§ 05 · THEDECISION When backups should be searched: the decision framework
§ 06 · DOING IT WELL Doing it well: targeted restoration methodology
§ 07 · THEARGUMENT Arguing the point: for access, and against it
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE + LIVE SYSTEM RECYCLE LAYERS SNAPSHOTS / BACKUP ARCHIVE / COUNTERPART DELETED / REPLICAS GENERATIONS JOURNALING COPIES RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THELEAVERPROCESSANDTHEQUARTER - ENDTAPES EXAMPLE2 · THEHOLDTHATNEVERREACHEDTHEROTATION EXAMPLE3 · THE " RUINOUS " RESTORATIONREPRICED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · B AC KUPLIMBFORTHE DAY- ONEPRESER VAT IONNOTICE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The backups-in-disclosure checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Do we have to preserve every backup we hold, forever? Are backups "disclosable documents"? Our key custodian's mailbox was deleted before the dispute. Is that spoliation? How much does targeted restoration actually cost now? Can we get access to the other side's backups directly? Cloud services back everything up anyway, don't they?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Should Backup Systems Be Searched For Disclosure, Computer Forensics Lab, https://e-discovery.uk/library/should-backup-systems-be-searched-for-disclosure/pdf.