Enterprise Database Forensics and Structured Data eDiscovery

Treat the Database as Evidence, Not as a Report

Databases record the transactions, account activity, payments, inventory movements and document versions that most commercial disputes turn on. The question in a database dispute is usually narrow, a disputed transaction, a deletion, an unauthorized edit or a demand to produce structured information, but the answer sits inside a system built for operations rather than for litigation. Global Digital Forensics defines the sources, the preservation method and the extraction that let an examiner or a review team answer that question from the record itself.

An export is a query somebody ran, with the joins, filters and date ranges that person chose. It can omit relationships, history, permissions, application logic and every row the query excluded. We begin by recording what an export contains and what else is needed to interpret it, because the gap between those two is where database disputes are won and lost.

If the other side's export is already on your desk, tell us the platform it came from and we will say what else should be requested.

Database Examiners With Mainframe, Transaction System and Courtroom Experience

Global Digital Forensics has served AmLaw 100 firms and Fortune 1000 companies since 1992. Its founder, Joseph Caruso, began his technology career in 1980, and that career spans software development, mainframe databases and real time transaction systems, including IBM mainframe environments. He holds the CISSP and Certified Forensic Examiner credentials. His class action work has reached airline reservation architecture, credit card transaction and deposit systems and the source code and configuration that drive them, and Global Digital Forensics served as database and data analysis experts in Rogers v. BNSF Railway. Robert Knudsen, a Certified Computer Examiner on our team, designed and deployed a crime statistics database during twenty years of police service before his forensic career.

That background is why litigators bring us the matters where the data arrives raw. In the massive data discovery matter, a New York law firm handling a class action received terabytes of financial data, documents, email and source code from a legacy mainframe with no access to the live system, and we extracted and correlated the email, documents and metadata into timelines that let counsel follow how the system was developed and patched. In the massive securities fraud matter, we identified which clearing firm actually controlled the trading records, guided the output of a decade of transactions, showed that the clearing firm's decompression routine had corrupted the first delivery, and rebuilt the application that recorded the trades so the trial team and its experts could examine the activity as if they had been in the brokerage at the time.

The examiner who did the work is the examiner who testifies to it, so ask on the first call who that would be for your platform.

Follow the Business Application and Every System It Talks To

We examine the application that creates and uses the data, not only the database engine beneath it. Accounting, payroll, customer management, reservations, inventory and enterprise resource planning systems exchange records with payment processors, reporting tools and outside organizations, and the record you need may have been written by one system, copied to a second and summarized by a third.

Before anything is collected we map the system of record, the replicated copies, the reporting databases, the integrations and the backups, and we find the transaction identifiers that connect evidence across sources even when their timestamps and field names differ. We also ask for the application documentation and for the people who understand the business process, because an examiner who does not understand the process will misread the table.

Ask a senior examiner to map the business application and its feeder systems for your platform before anything is collected; the process guide shows where that mapping sits in the engagement.

Know Which Database Sources Still Hold History

The sources we examine range from relational platforms and enterprise applications to mainframe databases, cloud hosted business systems and their supported exports, audit records, transaction logs, schema definitions and backup sets, document management and source code repositories with their version history, and the data warehouses and reports that transform the underlying records on the way to a dashboard.

What survives depends on platform configuration, permissions, licensing and retention. Earlier values of a row are recovered from the history that survives in logs, backups and warehouses. We say plainly which history exists, which has expired and which was never kept, because that is the distinction the other side will press on.

If a retention window may be closing on logs or backups, call (800) 868-8189 today rather than after the next purge.

Tell Us the Platform, the Question and the Deadline

A senior examiner will walk you through the sources, the preservation method and the production your matter needs. The initial consultation is free, and the 24/7 hotline is (800) 868-8189.

Get a Free Consultation

Preserve the Schema and Log Every Query First

With counsel and the data owner we define the relevant entities, fields, date ranges and relationships, record the access authority and the production constraints, and only then run queries. On a live business system we agree methods and timing that respect operational impact and the fact that the data keeps changing while the collection runs, which protects both the business and the record.

We preserve the schema and the supporting context needed to understand the data, and we document the query text, the parameters, the execution time, the source environment, the export settings and the row counts. Integrity checks follow every exported file, every transformation is recorded, and when a backup or snapshot is the source we identify its date and the restoration process. That record is what lets another qualified examiner follow the work and lets the retaining firm stand behind the collection when it is challenged.

Before any query is run on the live system, ask for the preservation plan in writing; the first conversation is free.

A Structured Data Production the Review Team Can Use

A review team needs more than a folder of tables. We agree formats, field definitions, relationships, identifiers, null values, encoding and time zone treatment, explain the joins, calculated fields, deduplication and filters, and reconcile output counts and sample records against the source wherever access permits. Because GDF owns its software, we process and host structured productions at a cost that suits small and midsize businesses as well as the largest matters.

The collected source, the analysis work and the production copies stay separate, with a reproducible record of how the requested output was created, so another reviewer understands why a record appears and what exclusions apply. Our eDiscovery production service covers the delivery requirements.

Review teams that need the production specification matched exactly should send the specification with the first inquiry.

Separate What the Data Shows From What It Suggests

Analysis compares versions, correlates transactions and examines the available evidence of changes and access. An account name does not automatically identify the person at the keyboard, and a missing record can result from retention, application design, filtering or an unavailable source as readily as from deletion. Our reports state the supported conclusions and the alternative explanations side by side.

Technical findings feed directly into counsel's legal and regulatory assessment. When the method or the interpretation will be contested, our database expert witness services carry the analysis into deposition and trial. Begin with the platform, the question, the relevant dates and the delivery deadline, and we will scope the rest.

Bring the platform name and the production deadline to the first call and the scope is drafted from them.

Related Database Services

Explore structured data eDiscovery scope and deliverables

Meet the forensic examiners behind the work