Narrator: Work Product Retention. 2 2
In this lesson, 3 3
we're going to quickly talk about work product retention, 4 4
which is a type of procedure and a policy 5 5
in the way that we hire somebody. 6 6
Now, when we deal with work product retention, 7 7
this is a contractual method 8 8
of retaining or hiring a forensic investigator 9 9
so that their analysis is protected from disclosure 10 10
by the work product doctrine. 11 11
Now, when you're dealing with a criminal or civil trial, 12 12
you're going to have these things 13 13
called discovery and disclosure. 14 14
These principles of discovery and disclosure 15 15
are going to govern the exchange of evidence 16 16
between the prosecution team and the defense team 17 17
in the civil or criminal trial. 18 18
Now, when we're dealing with digital forensics, 19 19
things get a little bit weird here. 20 20
Because if I was dealing with something 21 21
like fingerprints on a bottle, 22 22
that bottle would be something that would be admissible 23 23
as part of discovery and disclosure. 24 24
You'd have to give it to the other side. 25 25
So the prosecutor would give it to the defense attorney 26 26
so they could look at it as well. 27 27
Well, with digital forensics, 28 28
it doesn't necessarily work that way. 29 29
Because the thing you're actually collecting evidence from 30 30
is the hard drive, or the image from it, 31 31
your discovery and disclosure to the other side 32 32
is to give them a copy, an image, of that hard drive; 33 33
not your analysis, just the hard drive itself. 34 34
Their team has to do their own analysis 35 35
to try to see what they can come up with. 36 36
Now, the actual analysis of the evidence 37 37
that was collected by the person 38 38
and looked at and determined, 39 39
that is actually a product of work product retention. 40 40
And so if an attorney hires me, 41 41
they can retain me as an expert to perform the analysis. 42 42
Now, once I do that analysis, 43 43
that attorney can decide 44 44
whether or not to give it over to the other side. 45 45
So if I was hired by the prosecution, 46 46
they can decide whether or not 47 47
to give it to the defense attorney. 48 48
If I was hired by the defense, 49 49
they can decide whether or not to give it to the prosecutor. 50 50
The actual image itself, 51 51
both sides will have as part of discovery and disclosure. 52 52
But my analysis is owned by the attorney who contracts me. 53 53
That's how it works as a forensic analyst. 54 54
Now, to make sure you're protected 55 55
by this work product doctrine, 56 56
you need to make sure you're limiting the contact 57 57
with the company's CSIRT team, 58 58
and those people cannot help you with the analysis. 59 59
Instead, it all has to be done by you, the forensic analyst, 60 60
or your forensic analysis company. 61 61
Now, there's one more key thing here 62 62
when you're dealing with hiring an analyst. 63 63
As a company, you can't hire the analyst 64 64
and have this work product doctrine. 65 65
This is something that has to deal with 66 66
the way the law is written, 67 67
and so the attorney has to hire the analyst. 68 68
Now, you can do a three-way contract 69 69
where it's the investigator that you're hiring, 70 70
the attorney, and the company, 71 71
and they can use wording in the contract 72 72
such as "at the direction of outside counsel", 73 73
meaning that attorney, 74 74
in anticipation of litigation, 75 75
in which case, the company can be on the contract too. 76 76
But if you just have the company hiring an analyst, 77 77
that would be admissible under discovery and disclosure. 78 78
So you need to make sure the attorney is involved in this 79 79
whenever you're hiring an analyst 80 80
if you're the victim of a data breach 81 81
and you want to bring in some outside analyst 82 82
to help you with this.