The Defensible Multi Source Evidence Bundle

THEEVIDENCEBUNDLE · AGUIDEFORUKLAWYERS The Defensible Multi-Source Evidence Bundle Assembling Devices, Cloud, Network, Media and Open Sources Into One Coherent, Admissible Case COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE CASE ASSEMBLY TIMELINE & CONVERGENCE ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many witnesses, one case 03 The sources and what each contributes 04 Building the master timeline 05 Convergence, contradiction and weight 06 Integrity and provenance across every source 07 Deployment: presenting a coherent, admissible bundle 08 Source architecture: the whole estate at a glance 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: cases are proved not by one artefact but by many imperfect sources made to corroborate one another on a single timeline, so the decisive work is assembly, converging the evidence, resolving apparent contradictions, maintaining integrity across every source, and presenting the whole at honest confidence as a coherent, admissible bundle. § 0 2 · FIRSTPRINCIPLES The problem in plain English: many witnesses, one case § 0 3 · THESOURCES The sources and what each contributes DEVICES CLOUD NETWORK MEDIA / FINANCE OPEN SOURCES § 0 4 · THEMASTERTIMELINE Building the master timeline § 0 5 · CONVERGENCEANDWEIGHT Convergence, contradiction and weight § 0 6 · INTEGRITYACROSSEVERYSOURCE Integrity and provenance across every source § 0 7 · DEPLOYMENT Deployment: presenting a coherent, admissible bundle § 0 8 · THEWIDERMAP Source architecture: the whole estate at a glance CENTRAL NETWORK / FINANCIAL / OPEN FACT LOCATION CHAIN SOURCES DEVICES CLOUD MEDIA § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESIX - SOURCEALIBITHATHELD EXAMPLE2 · THECONTRADICTIONTHATWASREALLYACLOCK EXAMPLE3 · THESTRONGCASEUNDONEBYONEWEAKEXHIBIT § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes 1 and 3, §5). Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORAMU LT I - SOURCEASSEMB LY § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The multi-source bundle checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Why not just rely on the strongest single source? Our sources seem to contradict each other. Is the case lost? Why does the timeline matter so much? Can one weak exhibit really undermine a strong bundle? How is confidence stated for a whole bundle? Isn't assembling all this disproportionate for a smaller case? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY