Should Backup Systems Be Searched For Disclosure

BACKUPSINDISCLOSURE · AGUIDEFORUKLAWYERS Should Backup Systems Be Searched for Disclosure? Preservation, Proportionality and the Cases Where the Backup Is the Only Copy Left COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the archive everyone hopes to ignore 03 Preserve first, argue later: the legal baseline 04 Know what you actually have: backup technology in 05 When backups should be searched: the decision framework 06 Doing it well: targeted restoration methodology 07 Arguing the point: for access, and against it 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PRESERVATIONISNEAR - AUTOMATIC ; SEARCHINGISA REASONED , EVIDENCEDCHOICE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the archive everyone hopes to ignore § 0 3 · THEBASELINE Preserve first, argue later: the legal baseline § 0 4 · KNOWYOURESTATE Know what you actually have: backup technology in GENERATION WHAT IT LOOKS LIKE, AND WHAT RESTORATION REALLY COSTS § 0 5 · THEDECISION When backups should be searched: the decision framework § 0 6 · DOINGITWELL Doing it well: targeted restoration methodology § 0 7 · THEARGUMENT Arguing the point: for access, and against it § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE + LIVE SYSTEM RECYCLE LAYERS SNAPSHOTS / BACKUP ARCHIVE / COUNTERPART DELETED / REPLICAS GENERATIONS JOURNALING COPIES RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THELEAVERPROCESSANDTHEQUARTER - ENDTAPES EXAMPLE2 · THEHOLDTHATNEVERREACHEDTHEROTATION EXAMPLE3 · THE " RUINOUS " RESTORATIONREPRICED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · B AC KUPLIMBFORTHE DAY- ONEPRESER VAT IONNOTICE § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The backups-in-disclosure checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Do we have to preserve every backup we hold, forever? Are backups "disclosable documents"? Our key custodian's mailbox was deleted before the dispute. Is that spoliation? How much does targeted restoration actually cost now? Can we get access to the other side's backups directly? Cloud services back everything up anyway, don't they? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY