Web-forensics use case
Acquire digital-signature and document-transaction evidence
Eviquire can preserve an authorized digital-signature portal’s presentation of an envelope or transaction: participants, document version, consent and authentication screens, signing sequence, status history, audit trail, completion certificate, downloaded signed files, and the investigator’s acquisition record. This preserves what the service displayed and supplied; cryptographic signature validation and authoritative identity verification remain separate examinations.
What this use case means
Eviquire can preserve an authorized digital-signature portal’s presentation of an envelope or transaction: participants, document version, consent and authentication screens, signing sequence, status history, audit trail, completion certificate, downloaded signed files, and the investigator’s acquisition record. This preserves what the service displayed and supplied; cryptographic signature validation and authoritative identity verification remain separate examinations.
Signing services distribute evidence across invitation messages, transaction dashboards, document viewers, authentication steps, audit panels, completion certificates and downloaded files. A reviewer must be able to connect the displayed document to the correct transaction and version without accidentally signing, declining, voiding or notifying participants.
Common situations
When this workflow is useful
- Contract, employment, property, procurement or corporate disputes involving an electronic signing workflow
- Preserving a completed, pending, declined, expired or voided transaction before account access changes
- Documenting which version and audit materials an authorized participant or administrator could retrieve
Recommended process
A documented acquisition workflow
- Define authority and transaction
Identify the account role, transaction or envelope ID, relevant documents, participants, date range and actions that must not be triggered.
- Record portal and account context
Preserve the tenant, service, authenticated role, transaction status, locale, timezone and navigation path.
- Acquire the displayed history
Open document, participant, consent, authentication, event and audit views without changing the transaction; record unavailable fields and role-based differences.
- Preserve supplied originals
Download authorized signed documents, audit trails and completion certificates in their native supplied formats and retain their portal relationship.
- Verify independently where required
Hash files, record acquisition time, inspect embedded signatures or certificates with appropriate tools, and seek provider or identity records when disputed.
Technical guidance
Conditions that affect signature-portal evidence
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Transaction state and unintended actions
Opening a link or control may mark a document viewed, send a reminder, sign, decline or change an audit trail.
- Use a review or administrator view where authorized.
- Avoid action controls.
- Record investigator-caused events.
Document and certificate identity
A browser preview, downloaded PDF, audit report and completion certificate are different artifacts.
- Record transaction and document identifiers.
- Hash each supplied file separately.
- Preserve embedded signature data before conversion.
Identity and time
Names, email addresses, IP information and authentication labels shown by a portal are evidence sources, not conclusive identity proof.
- Record timezone and event semantics.
- Distinguish sending, viewing, signing and completion times.
- Correlate disputed identity with provider or organizational records.
Reviewable output
What the evidence package should explain
Transaction context
Service, tenant, envelope ID, status, document set, participant roles and sequence.
Displayed event history
Consent, authentication labels, views, signatures, status changes and audit presentation.
Native supplied files
Signed documents, audit reports and completion certificates preserved with hashes.
Review record
Session video, acquisition metadata, timestamps, limitations and chain of custody.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Do not interact with a live transaction beyond the authorized review scope.
- Signing records can contain identity, contract, financial and employment data requiring strict access and minimization.
- Do not equate a portal label with a legal conclusion about signature validity, attribution or enforceability.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire validate an electronic signature?
It preserves portal and file evidence. Dedicated signature-validation and legal analysis are separate steps.
Should the completion certificate be downloaded?
Yes when authorized, together with the signed document and transaction context.
Can viewing alter the audit trail?
It can. Use an appropriate review role and document any investigator-generated event.
Is a PDF preview the original signed file?
Not necessarily. Preserve the portal-supplied download separately.
Does an email address prove who signed?
No. It is one identity indicator that may require corroboration.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →