Page 1

DOCUMENT ACCESS EVIDENCE · A GUIDE FOR UK LAWYERS Who Accessed or Downloaded a Confidential Document Reading Access Trails Across Cloud Platforms, File Servers and Endpoints COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES ACCESS-LOG ANALYSIS

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: access is logged, and logs are not names 03 Cloud platforms: what Share Point, One Drive, Google Drive and SaaS record 04 File servers, DMS and end point s: the on-premises and local record 05 What each record proves: view, open, d own load, sync, print and share 06 Retention, licensing and the clocks that decide survival 07 From account to person: attribution and deployment 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: FILEACCESSISRECORDEDATTHEPLATFORM, THE SERVER AND THE END POINT, EACHNAMINGANACCOUNTRATHERTHANAPERSONANDEACHONITS OWNRETENTIONCLOCK: EXPORTTHELOGSFIRST, READWHATEACHEVENTACTUALLY MEANS, THENJOINACCOUNTTOPERSONWITHINDEPENDENTCORROBORATION

§ 02 · FIRST PRINCIPLES The problem in plain English: access is logged, and logs are not names

§ 03 · THECLOUDRECORD Cloud platforms: what Share Point, One Drive, Google Drive and SaaS record