Audit and discovery preparation

Commercial and contract dispute data gathering package

Map contract versions, email, collaboration, accounting records and logs before discussing preservation and collection with counsel.

Bagged hard drive beside a forensic write blocker.

Global Digital Forensics · Information gathering library · October 18, 2026

Read this guide freely. Choose a download, then share your work email and company or skip.

When you share your details, GDF records the requested resource with your introduction.

Your selected download starts immediately after you share your details or choose Skip.

No marketing subscription is created. Keep completed records in controlled systems.

Help counsel and a technical consultant locate the records of negotiation, agreement, performance, payment and change across business systems.

Attorneys, paralegals, business/medical contacts, project coordinators and client IT

Contract and commercial disputes, including digital agreements and performance records. The pack gathers the records that legal and expert review starts from.

Before you gather

Build a transaction chronology keyed to contract, project and customer identifiers. Collect the executed agreement together with the incorporated schedules, amendments, approvals and the actual performance records, because the documents that explain a deal sit in different legal, sales, finance, engineering and provider systems and the identifiers are what let a specialist connect them.

The record around a signed contract can include the negotiation history, the referenced cloud document, the signature envelope history and the completion certificate, and these often sit outside the PDF. Prior CRM field values and attachments sit in history tables and file stores beyond the current report, where the system keeps them. Ask the system owner what the actual export includes before the export is treated as the record, and write the answer down. Source data, displayed reports and later calculations are different records: preserve the source and identify how a report or a damages schedule was prepared, including the filters, assumptions, underlying transaction identifiers and cutoffs.

Sample discovery questions require counsel to tailor the defined terms, dates and scope and to review interrogatory limits, burden, privilege, third party control, local rules and case orders before anything is served.

Give each request to the suggested owner. Record each answer, including the items awaiting confirmation, in the editable CSV checklist. Keep the records themselves in a secure evidence location agreed with the recipient and use the checklist as the index that points to them; passwords stay with their owners, and real patient data and controlled technical information stay in the secure location.

Records to find

Download the editable gathering checklist. CSV files hold plain records, and your spreadsheet sets the layout. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.

CON-R01 Matter and transaction crosswalk

Ask
Business owner and legal
Gather
Claims/issues, parties and roles, key dates, agreement/project/order/customer IDs, relevant entities, periods and disputed provisions.
Where to ask
Counsel, sales and contract team
Why it may be needed
Links a legal question to actual business systems and identifiers.
If missing or uncertain
Separate disputed interpretation from agreed facts; record IDs to trace.

Reference: LG01 26; NY05 11-c

LG01 NY05

CON-R02 Agreement and incorporated material

Ask
Contract owner
Gather
Executed agreements, exhibits, referenced documents, statements of work, amendments, side letters, notices and version/effective dates.
Where to ask
Legal files, CLM, DMS and deal room
Why it may be needed
Defines which record family the specialist should organize.
If missing or uncertain
List incorporated documents and external links to locate.

Reference: LG01 34; NI04

LG01 NI04

CON-R03 Drafts and negotiation

Ask
Legal, sales and document owners
Gather
Relevant drafts/redlines/comments, version history, approval chains, emails/chats and negotiation notes within counsel approved scope.
Where to ask
Mail, collaboration, DMS and CLM
Why it may be needed
Shows development of the agreement and the actual custodians.
If missing or uncertain
Counsel handles privilege; collect and segregate factual metadata, and keep general questionnaires to facts.

Reference: LG01 26(b)(5); NY05 11-b; MS05

LG01 NY05 MS05

CON-R04 Signature and acceptance records

Ask
Signing service and contract owners
Gather
Envelope/agreement IDs, signed originals, history, completion certificate, recipient roles, delivery and acceptance records.
Where to ask
Signing provider, email and contracting system
Why it may be needed
Supplies supporting transaction records beyond the signature image.
If missing or uncertain
Availability turns on the account, permissions and retention, so ask the provider for the exact scope and field meanings.

Reference: DS01; LG02

DS01 LG02

CON-R05 Sales and commitments

Ask
Sales operations
Gather
CRM opportunities/quotes, product representations, pricing versions, approvals, attachments and relevant activity/history.
Where to ask
CRM, quoting tool, mail and proposals
Why it may be needed
Locates commercial representations and approval records.
If missing or uncertain
Determine available object/field history and linked file capture for this CRM and its configuration.

Reference: NI04; LG01

NI04 LG01

CON-R06 Procurement delivery and performance

Ask
Operations and project manager
Gather
Orders, shipment/delivery/receipt, work logs, milestones, acceptance/rejection, service tickets, quality records and change requests.
Where to ask
ERP, logistics, project, service and quality systems
Why it may be needed
Enables a chronology of performance and disputes.
If missing or uncertain
Record separate date meanings and partial deliveries; identify third party records.

Reference: NI04; LG01

NI04 LG01

CON-R07 Engineering and service versions

Ask
Engineering and service owner
Gather
Product/software/configuration versions, repository releases, change approvals, requirements and relevant existing technical logs.
Where to ask
Repositories, change systems and providers
Why it may be needed
Can connect what was promised, delivered, changed and supported.
If missing or uncertain
The earlier deployment is read from historical release and deployment records, so ask for those and their coverage dates.

Reference: NI04

NI04

CON-R08 Invoices payments and adjustments

Ask
Finance
Gather
Invoices, credits, payment/remittance records, accounts receivable/payable, journals, approval history and disputed bank detail changes.
Where to ask
ERP, banking records through owner, procurement
Why it may be needed
Supports traceable transaction and chronology review.
If missing or uncertain
Identify system/report cutoffs, currency and adjustments; specialist evaluates financial meaning.

Reference: NI04; LG01

NI04 LG01

CON-R09 Communications and meeting material

Ask
Custodians and collaboration owner
Gather
Relevant mail, chats, calls/recordings if made, minutes, internal/external channels and linked attachments.
Where to ask
D04 to D12 and D19
Why it may be needed
Captures non email discussions and external party collaboration.
If missing or uncertain
Identify meeting content held outside supported tools, external retention and recording practice; confirm whether calls were recorded before listing recordings.

Reference: MS02; GO01; SL02

MS02 GO01 SL02

CON-R10 Damages inputs and workbooks

Ask
Finance and legal
Gather
Existing source transactions, calculation files with formulas, assumptions, revisions and relationship to the claimed categories.
Where to ask
Finance systems and working files
Why it may be needed
Allows experts to test or explain calculations later.
If missing or uncertain
Keep native spreadsheets and source IDs, because the calculation model lives in the native file and the PDF summary reports its result.

Reference: LG01 26; NI04

LG01 NI04

CON-R11 Archives backups and former platforms

Ask
IT, archive and migration owners
Gather
D19 to D21, older deal rooms/tenants, catalogs, relevant dates and restoration feasibility.
Where to ask
Historical systems and providers
Why it may be needed
Looks for records held in former platforms and archives beyond the present application.
If missing or uncertain
Specialist evaluates proportionate isolated restoration; coordinator records known cost and access requirements.

Reference: LG01 26(b)(2); NI04

LG01 NI04

CON-R12 Third party and legal practice copies

Ask
Counsel and legal operations
Gather
Counterparty, broker, logistics, advisers, insurer and practice management source inventory, including portals and separate module exports.
Where to ask
D28 and D35
Why it may be needed
Maps distinct copies and possible lawful request paths.
If missing or uncertain
Counsel confirms authority file by file for adviser held material and reviews privilege and control.

Reference: LG01 34,45; CL01

LG01 CL01

CON-R13 Preservation and collection report

Ask
Legal and collector
Gather
Actual preservation/collection, source list, time zone, queries/filters, versions, exports, errors, chain of custody and known exclusions.
Where to ask
Preservation file and collection reports
Why it may be needed
Allows the receiving specialist to understand the record set's scope.
If missing or uncertain
Record partial families, open links and periods to collect.

Reference: NI04; MS06

NI04 MS06

Questions for client IT and owners

Download the response template. A useful answer names the actual system, period, supporting record and its coverage. Where the answer sits with someone else, name the person or provider who can give it.

1. Which IDs join the agreement, quote, order, project, invoice and support case?

Suggested responder
Client IT or system owner
Useful supporting record
Crosswalk with system owners and date definitions.

2. Where are versions, comments, approvals and side agreements kept?

Suggested responder
Client IT or system owner
Useful supporting record
DMS/CLM/workspace paths and relevant custodians.

3. What does the executed contract export include, and what sits elsewhere?

Suggested responder
Client IT or system owner
Useful supporting record
List of incorporated documents, signature artifacts and linked files.

4. Which records show delivery, acceptance, rejection or a requested change?

Suggested responder
Client IT or system owner
Useful supporting record
Existing operation records and their authors/dates.

5. How are sales/finance records corrected and can prior values be retrieved?

Suggested responder
Client IT or system owner
Useful supporting record
Audit/history settings and reports for the period.

6. Which outside parties hold distinct performance or transaction records?

Suggested responder
Client IT or system owner
Useful supporting record
Third party source list, ownership and proposed counsel request route.

7. How was each existing damages schedule generated?

Suggested responder
Client IT or system owner
Useful supporting record
Native workbook, source IDs, filters, periods and assumptions.

8. What was migrated or deleted, and what remains available elsewhere?

Suggested responder
Client IT or system owner
Useful supporting record
Migration/reconciliation and retention records.

Sample discovery prompts

Sample questions are drafting prompts for counsel, who shapes them into requests that fit the matter. Define the event, source, period and parties. Check relevance, proportionality, privilege, privacy, possession/custody/control, current local rules and case orders. Federal Rule 33 ordinarily allows up to 25 interrogatories, including discrete subparts, unless a stipulation or court order sets another number. New York uniform and Commercial Division rules and CPLR 3130 set their own conditions on interrogatories; especially check the interrogatory/deposition choice in negligence personal injury, property or wrongful death actions. Split or narrow prompts as the rules permit, and use a document request, interview or deposition topic where that is the appropriate device. Counsel decides what is served; these packages prepare the facts behind it.

Supporting procedural sources: LG01, NY05, NY06, NY07 and NY08. These questions are separate from the internal IT interview.

LG01 NY05 NY06 NY07 NY08
  1. Identify the custodians and repositories of the agreement identified as [agreement ID] and its incorporated schedules and amendments.
  2. Identify the systems used to store drafts, revisions and approvals for [defined agreement] during [period].
  3. Identify the signing service envelope or agreement identifiers and the custodian of the available history and completion certificate.
  4. Identify the order, project, invoice and support identifiers associated with [defined transaction].
  5. Identify the sources of records concerning [specified delivery or acceptance event] and their responsible custodians.
  6. Describe the report, fields, filters and source records used to prepare [identified factual transaction summary], excluding privileged advice.
  7. Identify relevant third party repositories and the factual basis of the responding party control over records within them.
  8. Identify known retention, migration or export limitations affecting [defined record class] during [period].

Download the drafting worksheet

Record the technical questions to discuss with counsel when preparing discovery requests.

Worked gathering example

Example only: An invoice dispute references a change order signed through an electronic signature service. The gathering team links the order ID, signed document, incorporated scope, envelope history and project acceptance records. It records each source to locate, and counsel addresses whether the change was legally effective.

Facts to confirm and specialist decisions

These are explicit handoff questions, and each one closes with the specialist's written answer, drawing on the records marked Received. Add client specific questions and a responsible person.

CON-Q01 Which agreement family, period and transaction issues define the request?

Ask
Counsel with business owner
Gather
Claim/case documents, agreement IDs, chronology and contract family
Resolution needed
Written scope and proposed search/collection plan.

CON-Q02 Which reports include history, attachments and relationships?

Ask
Application owner and receiving consultant
Gather
Export documentation, data dictionary, sample and error reports
Resolution needed
Documented export plan with the coverage of each report stated.

Download the open question register

Track decisions and open questions in one place.

Preparing the handoff

The handoff is ready when the agreement and transaction identifiers connect records across systems; when source records, summaries and calculated schedules remain distinguishable; when signature events and ordinary business records are organized for the expert's later evaluation; and when counsel approved scope, privilege handling and known open items accompany the file index.

Download the record index. Use the shared walkthrough for custody, restricted records, follow up on open items and receipt steps.

Sources for this package

Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. The package works alongside the actual contracts, facts, configuration and case orders.

Bring the completed pack to a free scoping call and a senior examiner sets the scope from it. Call (800) 868-8189.

Source review date: October 18 2026.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .

Privacy center

Choose your site settings

Optional technology stays off until you choose otherwise. You can change these browser settings at any time. Access to the core site does not depend on optional technologies.

Technology preferences
Sale or cross-context sharing: not used GDF does not sell or share website personal information for cross-context behavioral advertising.