Who Accessed Or Downloaded A Confidential Document

DOCUMENTACCESSEVIDENCE · AGUIDEFORUKLAWYERS Who Accessed or Downloaded a Confidential Document Reading Access Trails Across Cloud Platforms, File Servers and Endpoints COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ACCESS-LOG ANALYSIS § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: access is logged, and logs are not names 03 Cloud platforms: what SharePoint, OneDrive, Google Drive and SaaS record 04 File servers, DMS and endpoints: the on-premises and local record 05 What each record proves: view, open, download, sync, print and share 06 Retention, licensing and the clocks that decide survival 07 From account to person: attribution and deployment 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : FILEACCESSISRECORDEDATTHEPLATFORM , THESERVERAND THEENDPOINT , EACHNAMINGANACCOUNTRATHERTHANAPERSONANDEACHONITS OWNRETENTIONCLOCK : EXPORTTHELOGSFIRST , READWHATEACHEVENTACTUALLY MEANS , THENJOINACCOUNTTOPERSONWITHINDEPENDENTCORROBORATION § 0 2 · FIRSTPRINCIPLES The problem in plain English: access is logged, and logs are not names § 0 3 · THECLOUDRECORD Cloud platforms: what SharePoint, OneDrive, Google Drive and SaaS record § 0 4 · THEON - PREMISESANDLOCALRECORD File servers, DMS and endpoints: the on-premises and local record § 0 5 · WHATEACHEVENTPROVES What each record proves: view, open, download, sync, print and share § 0 6 · THECLOCKS Retention, licensing and the clocks that decide survival § 0 7 · FROMACCOUNTTOPERSON From account to person: attribution and deployment 99 §6's clocks), and leak inquiries where the access population narrows the candidates: the finding drafted to § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION SESSION COPY + PLATFORM ENDPOINT PHYSICAL DELETED/ AUDIT LOG ARTEFACTS LAYER EXPIRED SIGN-IN / DOWNSTREAM LAYER RECIPIENT § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEBOARDPAPERANDTHEFORTY - ONEACCOUNTS EXAMPLE2 · THESERVERTHATWASNEVERLISTENING EXAMPLE3 · THEACCESSTHATWASAPREVIEW , ANDTHEDISCIPLINARYTHATWAS WITHDRAWN § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · AC CESS - RECORDPRESER VAT IONANDDISCLOSUREREQUEST § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The access-investigation checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can we find out who opened a document on SharePoint? How long do access logs last? The file server has no access logs. Is the trail cold? The log says my client's account accessed the record. Is that the end of it? Can access to a document be proved after it was deleted? Someone photographed the screen. Can that be traced? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY