Page 1
EPHEMERALMESSAGINGEVIDENCE · A GUIDE FOR UK LAWYERS Signal and Ephemeral Messaging Disappearing Messages, Designed Forgetting and What Litigation Can Still Reach COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EPHEMERAL-APP ANALYSIS RESIDUE & COUNTERPART CAPTURE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: engineered forgetting meets the duty to remember 03 The landscape: Signal, Telegram, Snapchat and disappearing modes 04 What exam in at i on can still reach: the residue map 05 Preservation duties and the moment they bite 06 Channel choice as conduct: inference and chronology 07 Corporate governance: business use of ephemeral apps 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: EPHEMERALAPPSMOSTLYKEEPTHEIRPROMISES: AND LITIGATIONSTILLREACHESTHEMTHROUGHRESIDUE, COUNTERPARTS, CONDUCT AND DUTY
§ 02 · FIRST PRINCIPLES The problem in plain English: engineered forgetting meets the duty to remember
§ 03 · THELANDSCAPE The landscape: Signal, Telegram, Snapchat and disappearing modes APP / MODE EVIDENTIAL CHARACTER
Page 2
§ 04 · THERESIDUEMAP What exam in at i on can still reach: the residue map
§ 05 · THEDUTY Preservation duties and the moment they bite
§ 06 · THECHOICEASCONDUCT Channel choice as conduct: inference and chronology
§ 07 · GOVERNANCE Corporate governance: business use of ephemeral apps
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DEVICE COMPANION (EMAIL, ENTERPRISE EXPIRING DESKTOP / SURROUND PROVIDER / (RESIDUE) CLIENTS WHATSAPP, CONSOLE COUNTERPART DELETED / DEVICES RECOVERABLE RECORDFUL TEAMS)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEMIGRATIONMESSAGETHATFRAMEDTHESILENCE EXAMPLE2 · THECOUNTERPARTWHOKEPTRECEIPTS EXAMPLE3 · THETIMERSTHATKEPTRUNNING
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · EPHEMERALLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The ephemeral checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can deleted or expired Signal messages be recovered? Is it unlawful for a business to use disappearing messages? The opponent says the messages expired innocently under settings predating the dispute. Does that end it? A witness offers screenshots of expired chats. How much weight can they carry? Do adverse inferences really substitute for the messages themselves? What should a client adopting Signal for business do this week?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 70. Conflicts checks, confidential scoping discussions and fixed-fee estimates are routine; and if a relevant chat Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Signal And Ephemeral Messaging, Computer Forensics Lab, https://e-discovery.uk/library/signal-and-ephemeral-messaging/pdf.