The Missing Evidence Problem
MISSINGEVIDENCE · A GUIDE FOR UK LAWYERS The Missing Evidence Problem Proving What Should Exist, Finding Where It Went, and Litigating the Gap COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: gaps have causes, and causes leave evidence 03 Proving existence: the traces that show what was once there 04 Innocent or engineered: distinguishing routine loss from destruction 05 The recovery map: where missing material survives 06 Preservation duties and their breach: the legal framework 07 Litigating the gap: applications, inferences and remedies 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: MISSINGEVIDENCEISINVESTIGATEDINTHREEMOVES: PROVEIT EXISTED, EXPLAINITSABSENCE, ANDPURSUEITWHEREITSTILLSURVIVES: WITHTHE LITIGATIONCONSEQUENCESFLOWINGFROMWHATTHOSEMOVESESTABLISH
§ 02 · FIRST PRINCIPLES The problem in plain English: gaps have causes, and causes leave evidence
§ 03 · THEOUTLINEOFTHEVANISHED Proving existence: the traces that show what was once there
§ 04 · READINGTHECAUSE Innocent or engineered: distinguishing routine loss from destruction
§ 05 · THE RECOVERY MAP The recovery map: where missing material survives
§ 06 · THEDUTYCLOCK Preservation duties and their breach: the legal framework
§ 07 · THECONSEQUENCES Litigating the gap: applications, inferences and remedies
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE RECYCLE PRESERVATION SURVIVING SYSTEM DUPLICATES / DEVICE REFERENCES BOOKKEEPING COUNTERPARTS RESIDUE BACKUPS / POLICY / STORES FILE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEFORTNIGHTTHATFELLSILENT EXAMPLE2 · THEPHONEINTHERIVERANDTHECLOUDTHATREMEMBERED EXAMPLE3 · THEGAPTHEPOLICYEXPLAINED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · PRESERVATION AND LOSS - EXPLAN AT I ON REQUEST
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The missing-evidence checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The other side says the documents were deleted under a retention policy. Is that the end of it? Can deleted material really be recovered, or is that television? How do we prove something existed if it no longer does? When does the duty to preserve actually start? Will a court really draw an adverse inference? We have discovered our own client's gap. What now?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, The Missing Evidence Problem, Computer Forensics Lab, https://e-discovery.uk/library/the-missing-evidence-problem/pdf.