Page 1

THE FIRST MEETING · A GUIDE FOR UK LAWYERS The First e Disclosure Meeting 50 Questions Lawyers Should Ask COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 Why the first meeting matters, practically and legally 03 How to run the meeting 04 Questions 1-5 · IT architecture 05 Questions 6-10 · Custodians 06 Questions 11-15 · Devices 07 Questions 16-20 · Cloud services 08 Questions 21-25 · Deleted data 09 Questions 26-30 · Retention and backups 10 Questions 31-35 · Preservation actions 11 Questions 36-40 · Privacy and data protection 12 Questions 41-45 · Privilege 13 Questions 46-50 · Third parties 14 After the meeting: converting answers into actions 15 Red-flag answers 16 Common mistakes · Suggested wording 17 Checklist · When to involve a digital forensic expert 18 Frequently asked questions 19 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: WHYFIFTYSTRUCTUREDQUESTIONS

§ 02 · FIRST PRINCIPLES Why the first meeting matters, practically and legally

§ 03 · METHOD How to run the meeting