±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 5
New Yesterday: 5
Overall: 27325
Visitors: 58

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Legal privilege

Discussion of legislation relating to computer forensics.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 3:05 pm

Why would you want a video of the examination - I have done quite a few of these cases and involved in a lot more and that has never been a requirement. What you do is not at issue, its what you produce at the end of the case. It just over complicate the matter and adds nothing at the end.

Typically, or rather almost invariably when lawyers are involved, they will want to look at every document that the other side wants and the respondent will claim privilege on things that aren't and the supervising solicitor will review and make a decision.
_________________
Paul Sanderson
Forensic Toolkit for SQLite
sandersonforensics.com...ic-Toolkit
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 3:55 pm

- PaulSanderson
Why would you want a video of the examination - I have done quite a few of these cases and involved in a lot more and that has never been a requirement. What you do is not at issue, its what you produce at the end of the case. It just over complicate the matter and adds nothing at the end.


A video over complicates nothing, merely adds support to the work undertaken. As I read fab4's question the work undertaken for the examination is in issue to prove no reproduction from a particular folder during the examination. Better to be safe, than overly self-confident.

What you aren't doing is illustrating for fab4 examination techniques, from the experience you say you have, that shares the benefit of your experience as to what could be done for examining this mobile/smart phone for evidence.


- PaulSanderson
the respondent


I thought the prosecution in criminal proceedings were asking for the evidence?
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Mon Dec 03, 2012 6:54 pm

Thanks guys. All varied and useful responses.

I conclude that several considerations currently need to be undertaken by the CPS (in agreement with the suspect's representatives);

designation of privilege docs prior to/during examination,

allocation of an independent barrister/lawyer to advise on privilege during the examination and/or to review the acquired image to advise on privilege and/or to review the examination outputs (including stated sources of evidential data) to ensure that privilege has been fully observed in the report submitted to the Court,

escalation of disagreements re: privilege to the Court.

I also note the (slightly contested) discussion about videoing the examination.

- Jonathan
Probably something to do with that pesky presumed innocence thing.
Brilliant.

Thanks again. Any further opinions extremely welcome.  

Fab4
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Tue Dec 04, 2012 4:31 am

I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.
_________________
Paul Sanderson
Forensic Toolkit for SQLite
sandersonforensics.com...ic-Toolkit
www.twitter.com/sandersonforens
www.facebook.com/recon...resoftware 

PaulSanderson
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Tue Dec 04, 2012 11:14 am

- PaulSanderson
What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.


Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.

Thanks again to all.  

Fab4
Senior Member
 
 
  

Re: Legal privilege

Post Posted: Tue Dec 04, 2012 5:00 pm

- Fab4
....CPS have directed that some devices are to be examined............Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire?


"If there is a large volume of ESI, you should discuss the best method for it to be searched, collected, filtered and reviewed with your lawyer."
www.out-law.com/en/top...privilege/

- PaulSanderson
I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.


I'm not suggesting paul you're not being constructive and let me make it clear I didn't think that about or of you when I raised my observations. People differ in the way an examination can be conducted. I accept we all approach matters differently.

I realise now that I should have used 'e.g.' in my last post when I mentioned smartphone because I didn't know the devices fab4 would be faced with. The smartphone anology was used merely to represent where lawyers may have material stored e.g. on Blackberry devices.

"A typical smart phone contains a 2 GB removable memory card, which can contain the equivalent of 40 banker’s boxes of paper, or 100,000 pages."
A Litigation Neccesity: Electronically Stored Information (ESI) Review Tools

I would welcome though if anyone can provide by reference to a weblink or a rule that states you mustn't video or it is seen as not required during a device examination where ESI privilege documents maybe present.

- Fab4
- PaulSanderson
What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.


Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.

Thanks again to all.


fab4 this is your case and you are doing the work and will know the devices. My observations are just that and are not intended to hold you back. As you state you will run with what is best for you and in the case. Good luck with whatever you proceed to do.
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 2
Go to page Previous  1, 2