I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.
What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.
Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.
Thanks again to all.
….CPS have directed that some devices are to be examined…………Is it simply a case of providing an undertaking that I will not analyse the contents of named directories/files, which clearly will be contained in the image I acquire?
"If there is a large volume of ESI, you should discuss the best method for it to be searched, collected, filtered and reviewed with your lawyer."
http//
I was being constructive greg - some people/companies over complicate things - IMHO videoing is not required for the reasons I stated. What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.
I'm not suggesting paul you're not being constructive and let me make it clear I didn't think that about or of you when I raised my observations. People differ in the way an examination can be conducted. I accept we all approach matters differently.
I realise now that I should have used 'e.g.' in my last post when I mentioned smartphone because I didn't know the devices fab4 would be faced with. The smartphone anology was used merely to represent where lawyers may have material stored e.g. on Blackberry devices.
"A typical smart phone contains a 2 GB removable memory card, which can contain the equivalent of 40 banker’s boxes of paper, or 100,000 pages."
A Litigation Neccesity Electronically Stored Information (ESI) Review Tools
I would welcome though if anyone can provide by reference to a weblink or a rule that states you mustn't video or it is seen as not required during a device examination where ESI privilege documents maybe present.
What you do in a privilege case is no different than what you do in in any other computer forensic investigation so why treat it differently. The output is the issue, not the procedure.
Having thought about it overnight, this is the conclusion I came to and discussed with LE first thing this morning. If the lawyers decide to engage an independent peer to whatever degree before/during/after the examination, that is their call. For me, the gig is the same (on the data classified as not privileged) in relation to process, tools, notes and output.
Thanks again to all.
fab4 this is your case and you are doing the work and will know the devices. My observations are just that and are not intended to hold you back. As you state you will run with what is best for you and in the case. Good luck with whatever you proceed to do.