Page 1

EPHEMERALMESSAGINGEVIDENCE · A GUIDE FOR UK LAWYERS Signal and Ephemeral Messaging Disappearing Messages, Designed Forgetting and What Litigation Can Still Reach COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES EPHEMERAL-APP ANALYSIS RESIDUE & COUNTERPART CAPTURE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: engineered forgetting meets the duty to remember 03 The landscape: Signal, Telegram, Snapchat and disappearing modes 04 What exam in at i on can still reach: the residue map 05 Preservation duties and the moment they bite 06 Channel choice as conduct: inference and chronology 07 Corporate governance: business use of ephemeral apps 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: EPHEMERALAPPSMOSTLYKEEPTHEIRPROMISES: AND LITIGATIONSTILLREACHESTHEMTHROUGHRESIDUE, COUNTERPARTS, CONDUCT AND DUTY

§ 02 · FIRST PRINCIPLES The problem in plain English: engineered forgetting meets the duty to remember

§ 03 · THELANDSCAPE The landscape: Signal, Telegram, Snapchat and disappearing modes APP / MODE EVIDENTIAL CHARACTER