Database Forensics and Database eDiscovery

Databases as electronic evidence

Databases can document transactions, account activity, inventory, payments, document versions and changes to business records. The question may concern a disputed transaction, a deletion, an unauthorized edit or a request to produce structured information. Global Digital Forensics helps define the sources, preservation method and extraction needed for examination or eDiscovery.

A spreadsheet export is only one view of a database. It may omit relationships, history, permissions, application logic or records excluded by a query. A useful collection plan records what an export includes and what additional material is needed to interpret it.

Follow the business application and its connections

Examine the application that creates and uses the data, not just the database engine. Accounting, payroll, customer management, reservations, inventory and enterprise resource planning systems can exchange records with payment services, reporting tools and other organizations.

Map those connections before collection. Identify the system of record, replicated copies, reporting databases, integrations and backups. A transaction identifier may connect evidence across several sources even when their timestamps or field names differ. Include application documentation and people who understand the business process.

Sources and systems to consider

• Relational platforms such as Microsoft SQL Server, Oracle, PostgreSQL and MySQL.
• Enterprise applications, accounting packages and mainframe databases.
• Cloud-hosted business systems and their supported exports or interfaces.
• Audit records, transaction logs, schema definitions and backup sets.
• Document management, source-code repositories and version-history systems.
• Data warehouses and reports that transform the underlying records.

Availability depends on platform configuration, permissions, licensing and retention. Audit logging cannot reconstruct activity that was never recorded. A current record may not reveal its earlier values unless history survives elsewhere.

Discuss the sources and deadline

Tell us what you need to establish and which systems are available.

Talk with a forensic expert

Preservation and extraction planning

Define the relevant entities, fields, date ranges and relationships with counsel and the data owner. Record access authority and production constraints before running queries. For a live business system, agree on methods and timing that account for operational impact and data changing during collection.

Preserve the schema and supporting context needed to understand the data. Document query text, parameters, execution time, source environment, export settings and row counts. Retain integrity checks for exported files and a record of transformations. When a backup or snapshot is used, identify its date and the restoration process.

Make a structured-data production usable

A review team needs more than a folder of tables. Agree on formats, field definitions, relationships, identifiers, null values, encoding and time-zone treatment. Explain joins, calculated fields, deduplication and filters. Reconcile output counts and sample records against the source where access permits.

Separate the collected source from analysis work and production copies. Keep a reproducible record of how the requested output was created. This allows another reviewer to understand why a record appears and what exclusions apply. Our eDiscovery production service covers the delivery requirements.

Findings, testimony and limits

Analysis can compare versions, correlate transactions and examine available evidence of changes or access. An account name does not automatically identify the person operating it. Missing records can result from retention, application design, filtering or unavailable sources as well as deletion.

The report should state supported conclusions and alternative explanations. Technical findings can support counsel's legal and regulatory assessment without replacing it. For disputed methods or interpretation, see database expert witness services. Begin an inquiry with the platform, question, relevant dates and required delivery deadline.

Related technical service

Explore the service scope and deliverables

Meet our forensic experts