1 1 00:00:00,330 --> 00:00:02,580 Work Product Retention. 2 2 00:00:02,580 --> 00:00:03,450 In this lesson, 3 3 00:00:03,450 --> 00:00:06,360 we're going to quickly talk about work product retention, 4 4 00:00:06,360 --> 00:00:08,580 which is a type of procedure and a policy 5 5 00:00:08,580 --> 00:00:10,470 in the way that we hire somebody. 6 6 00:00:10,470 --> 00:00:12,360 Now, when we deal with work product retention, 7 7 00:00:12,360 --> 00:00:13,920 this is a contractual method 8 8 00:00:13,920 --> 00:00:16,800 of retaining or hiring a forensic investigator 9 9 00:00:16,800 --> 00:00:19,320 so that their analysis is protected from disclosure 10 10 00:00:19,320 --> 00:00:21,300 by the work product doctrine. 11 11 00:00:21,300 --> 00:00:24,390 Now, when you're dealing with a criminal or civil trial, 12 12 00:00:24,390 --> 00:00:25,500 you're going to have these things 13 13 00:00:25,500 --> 00:00:27,570 called discovery and disclosure. 14 14 00:00:27,570 --> 00:00:29,580 These principles of discovery and disclosure 15 15 00:00:29,580 --> 00:00:31,440 are going to govern the exchange of evidence 16 16 00:00:31,440 --> 00:00:34,320 between the prosecution team and the defense team 17 17 00:00:34,320 --> 00:00:36,630 in the civil or criminal trial. 18 18 00:00:36,630 --> 00:00:38,670 Now, when we're dealing with digital forensics, 19 19 00:00:38,670 --> 00:00:40,560 things get a little bit weird here. 20 20 00:00:40,560 --> 00:00:41,970 Because if I was dealing with something 21 21 00:00:41,970 --> 00:00:43,980 like fingerprints on a bottle, 22 22 00:00:43,980 --> 00:00:46,170 that bottle would be something that would be admissible 23 23 00:00:46,170 --> 00:00:47,670 as part of discovery and disclosure. 24 24 00:00:47,670 --> 00:00:49,380 You'd have to give it to the other side. 25 25 00:00:49,380 --> 00:00:51,270 So the prosecutor would give it to the defense attorney 26 26 00:00:51,270 --> 00:00:52,950 so they could look at it as well. 27 27 00:00:52,950 --> 00:00:54,570 Well, with digital forensics, 28 28 00:00:54,570 --> 00:00:56,640 it doesn't necessarily work that way. 29 29 00:00:56,640 --> 00:00:58,950 Because the thing you're actually collecting evidence from 30 30 00:00:58,950 --> 00:01:01,440 is the hard drive, or the image from it, 31 31 00:01:01,440 --> 00:01:03,750 your discovery and disclosure to the other side 32 32 00:01:03,750 --> 00:01:06,840 is to give them a copy, an image, of that hard drive; 33 33 00:01:06,840 --> 00:01:09,990 not your analysis, just the hard drive itself. 34 34 00:01:09,990 --> 00:01:12,030 Their team has to do their own analysis 35 35 00:01:12,030 --> 00:01:13,860 to try to see what they can come up with. 36 36 00:01:13,860 --> 00:01:15,660 Now, the actual analysis of the evidence 37 37 00:01:15,660 --> 00:01:17,340 that was collected by the person 38 38 00:01:17,340 --> 00:01:18,990 and looked at and determined, 39 39 00:01:18,990 --> 00:01:21,780 that is actually a product of work product retention. 40 40 00:01:21,780 --> 00:01:23,550 And so if an attorney hires me, 41 41 00:01:23,550 --> 00:01:26,730 they can retain me as an expert to perform the analysis. 42 42 00:01:26,730 --> 00:01:28,320 Now, once I do that analysis, 43 43 00:01:28,320 --> 00:01:29,610 that attorney can decide 44 44 00:01:29,610 --> 00:01:31,590 whether or not to give it over to the other side. 45 45 00:01:31,590 --> 00:01:33,330 So if I was hired by the prosecution, 46 46 00:01:33,330 --> 00:01:34,500 they can decide whether or not 47 47 00:01:34,500 --> 00:01:36,120 to give it to the defense attorney. 48 48 00:01:36,120 --> 00:01:37,470 If I was hired by the defense, 49 49 00:01:37,470 --> 00:01:40,080 they can decide whether or not to give it to the prosecutor. 50 50 00:01:40,080 --> 00:01:41,460 The actual image itself, 51 51 00:01:41,460 --> 00:01:44,340 both sides will have as part of discovery and disclosure. 52 52 00:01:44,340 --> 00:01:48,030 But my analysis is owned by the attorney who contracts me. 53 53 00:01:48,030 --> 00:01:50,610 That's how it works as a forensic analyst. 54 54 00:01:50,610 --> 00:01:51,930 Now, to make sure you're protected 55 55 00:01:51,930 --> 00:01:53,670 by this work product doctrine, 56 56 00:01:53,670 --> 00:01:55,620 you need to make sure you're limiting the contact 57 57 00:01:55,620 --> 00:01:57,510 with the company's CSIRT team, 58 58 00:01:57,510 --> 00:02:00,690 and those people cannot help you with the analysis. 59 59 00:02:00,690 --> 00:02:03,480 Instead, it all has to be done by you, the forensic analyst, 60 60 00:02:03,480 --> 00:02:05,880 or your forensic analysis company. 61 61 00:02:05,880 --> 00:02:07,470 Now, there's one more key thing here 62 62 00:02:07,470 --> 00:02:09,660 when you're dealing with hiring an analyst. 63 63 00:02:09,660 --> 00:02:12,060 As a company, you can't hire the analyst 64 64 00:02:12,060 --> 00:02:14,130 and have this work product doctrine. 65 65 00:02:14,130 --> 00:02:15,450 This is something that has to deal with 66 66 00:02:15,450 --> 00:02:16,710 the way the law is written, 67 67 00:02:16,710 --> 00:02:18,750 and so the attorney has to hire the analyst. 68 68 00:02:18,750 --> 00:02:20,970 Now, you can do a three-way contract 69 69 00:02:20,970 --> 00:02:22,950 where it's the investigator that you're hiring, 70 70 00:02:22,950 --> 00:02:24,510 the attorney, and the company, 71 71 00:02:24,510 --> 00:02:26,040 and they can use wording in the contract 72 72 00:02:26,040 --> 00:02:28,020 such as "at the direction of outside counsel", 73 73 00:02:28,020 --> 00:02:29,130 meaning that attorney, 74 74 00:02:29,130 --> 00:02:31,770 in anticipation of litigation, 75 75 00:02:31,770 --> 00:02:34,590 in which case, the company can be on the contract too. 76 76 00:02:34,590 --> 00:02:37,170 But if you just have the company hiring an analyst, 77 77 00:02:37,170 --> 00:02:39,780 that would be admissible under discovery and disclosure. 78 78 00:02:39,780 --> 00:02:42,060 So you need to make sure the attorney is involved in this 79 79 00:02:42,060 --> 00:02:43,500 whenever you're hiring an analyst 80 80 00:02:43,500 --> 00:02:44,910 if you're the victim of a data breach 81 81 00:02:44,910 --> 00:02:46,560 and you want to bring in some outside analyst 82 82 00:02:46,560 --> 00:02:47,660 to help you with this.