Page 1
THE EVIDENCE BUNDLE · A GUIDE FOR UK LAWYERS The Defensible Multi-Source Evidence Bundle Assembling Devices, Cloud, Network, Media and Open Sources Into One Coherent, Admissible Case COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MULTI-SOURCE CASE ASSEMBLY TIMELINE & CONVERGENCE ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many witnesses, one case 03 The sources and what each contributes 04 Building the master timeline 05 Convergence, contradiction and weight 06 Integrity and provenance across every source 07 Deployment: presenting a coherent, admissible bundle 08 Source architecture: the whole estate at a glance 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: cases are proved not by one artefact but by many imperfect sources made to corroborate one another on a single timeline, so the decisive work is assembly, converging the evidence, resolving apparent contradictions, maintaining integrity across every source, and presenting the whole at honest confidence as a coherent, admissible bundle.
§ 02 · FIRST PRINCIPLES The problem in plain English: many witnesses, one case
§ 03 · THE SOURCES The sources and what each contributes DEVICES CLOUD NETWORK MEDIA / FINANCE OPEN SOURCES
Page 2
§ 04 · THEMASTERTIMELINE Building the master timeline
§ 05 · CONVERGENCEANDWEIGHT Convergence, contradiction and weight
§ 06 · INTEGRITY ACROSS EVERY SOURCE Integrity and provenance across every source
§ 07 · DEPLOYMENT Deployment: presenting a coherent, admissible bundle
§ 08 · THEWIDERMAP Source architecture: the whole estate at a glance CENTRAL NETWORK / FINANCIAL / OPEN FACT LOCATION CHAIN SOURCES DEVICES CLOUD MEDIA
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESIX - SOURCEALIBITHATHELD EXAMPLE2 · THECONTRADICTIONTHATWASREALLYACLOCK EXAMPLE3 · THESTRONGCASEUNDONEBYONEWEAKEXHIBIT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes 1 and 3,
§ 5). Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORAMU LT I-SOURCEASSEMB LY
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The multi-source bundle checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why not just rely on the strongest single source? Our sources seem to contradict each other. Is the case lost? Why does the timeline matter so much? Can one weak exhibit really undermine a strong bundle? How is confidence stated for a whole bundle? Isn't assembling all this disproportionate for a smaller case?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, The Defensible Multi Source Evidence Bundle, Computer Forensics Lab, https://e-discovery.uk/library/the-defensible-multi-source-evidence-bundle/pdf.