The Missing Evidence Problem

MISSINGEVIDENCE · AGUIDEFORUKLAWYERS The Missing Evidence Problem Proving What Should Exist, Finding Where It Went, and Litigating the Gap COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: gaps have causes, and causes leave evidence 03 Proving existence: the traces that show what was once there 04 Innocent or engineered: distinguishing routine loss from destruction 05 The recovery map: where missing material survives 06 Preservation duties and their breach: the legal framework 07 Litigating the gap: applications, inferences and remedies 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : MISSINGEVIDENCEISINVESTIGATEDINTHREEMOVES : PROVEIT EXISTED , EXPLAINITSABSENCE , ANDPURSUEITWHEREITSTILLSURVIVES : WITHTHE LITIGATIONCONSEQUENCESFLOWINGFROMWHATTHOSEMOVESESTABLISH § 0 2 · FIRSTPRINCIPLES The problem in plain English: gaps have causes, and causes leave evidence § 0 3 · THEOUTLINEOFTHEVANISHED Proving existence: the traces that show what was once there § 0 4 · READINGTHECAUSE Innocent or engineered: distinguishing routine loss from destruction § 0 5 · THERECOVERYMAP The recovery map: where missing material survives § 0 6 · THEDUTYCLOCK Preservation duties and their breach: the legal framework § 0 7 · THECONSEQUENCES Litigating the gap: applications, inferences and remedies § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE RECYCLE PRESERVATION SURVIVING SYSTEM DUPLICATES / DEVICE REFERENCES BOOKKEEPING COUNTERPARTS RESIDUE BACKUPS / POLICY / STORES FILE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEFORTNIGHTTHATFELLSILENT EXAMPLE2 · THEPHONEINTHERIVERANDTHECLOUDTHATREMEMBERED EXAMPLE3 · THEGAPTHEPOLICYEXPLAINED § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · PRESER VAT IONANDLOSS - EXPLAN AT IONREQUEST § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The missing-evidence checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The other side says the documents were deleted under a retention policy. Is that the end of it? Can deleted material really be recovered, or is that television? How do we prove something existed if it no longer does? When does the duty to preserve actually start? Will a court really draw an adverse inference? We have discovered our own client's gap. What now? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY