Web-forensics use case
Acquire evidence from HR and employee web portals
Eviquire can document narrowly scoped records presented through an authorized browser-based HR, recruitment, attendance, expense, learning, or employee-case portal. It preserves the web presentation and authorized exports with acquisition records; it does not replace the HR database, payroll engine, identity provider, endpoint, or provider backend.
What this use case means
Eviquire can document narrowly scoped records presented through an authorized browser-based HR, recruitment, attendance, expense, learning, or employee-case portal. It preserves the web presentation and authorized exports with acquisition records; it does not replace the HR database, payroll engine, identity provider, endpoint, or provider backend.
HR portals contain highly sensitive information and expose different fields to employees, managers, HR, legal, and administrators. Records may combine manual entries, automated calculations, uploaded files, approvals, and linked systems. The acquisition must be proportionate, role-aware, access-controlled, and explicit about what the portal did and did not show.
Common situations
When this workflow is useful
- Authorized misconduct, discrimination, attendance, expense, recruitment, policy, grievance, fraud, or compliance investigations
- Preserving approvals, acknowledgements, case histories, submissions, or attachments for legal and HR review
- Documenting a record before workflow, retention, employment status, or permissions change
Recommended process
A documented acquisition workflow
- Establish mandate and safeguards
Confirm the authorizing function, legal and privacy oversight, subjects, record types, dates, exclusions, privilege, and review group.
- Document account role
Record tenant, HR or manager role, effective permissions, timezone, locale, and authentication conditions.
- Acquire only relevant records
Navigate from employee, candidate, case, or workflow to the selected records, histories, approvals, acknowledgements, and attachments.
- Protect and verify
Preserve authorized exports, hash originals, create controlled redaction copies, restrict the case, and record custody and retention decisions.
Technical guidance
Conditions that affect HR portal acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Role and fairness
Different roles see different personal, performance, health, pay, grievance, and investigation information.
- Use least privilege.
- Record the role and purpose.
- Do not infer unavailable fields are absent.
Mutable workflows
Opening, approving, commenting, or downloading may create notifications, audit entries, or workflow changes.
- Prefer read-only review.
- Avoid decisions and communications during acquisition.
- Document investigator-caused events.
Sensitive outputs
Exports may contain more people or fields than the visible selection.
- Inspect scope before export.
- Protect originals and create redacted derivatives.
- Separate evidence collection from employment decisions.
Reviewable output
What the evidence package should explain
Portal and role context
Tenant, account role, subject, workflow, dates, and permissions.
Relevant HR record
Displayed entries, histories, approvals, acknowledgements, and session activity.
Files and exports
Authorized originals with hashes and controlled derivatives.
Restricted case
Integrity, custody, access, retention, and review records.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Coordinate qualified HR, legal, privacy, security, and employee-relations stakeholders.
- Public or internal availability does not remove necessity, fairness, proportionality, and retention obligations.
- Eviquire does not decide misconduct, entitlement, performance, or employment outcomes.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can HR portal records be acquired?
Yes when access, purpose, and scope are properly authorized.
Should the whole employee file be captured?
Normally no; collect only relevant and proportionate records.
Can opening a record affect the portal?
It may create audit events, notifications, or workflow changes.
How should sensitive evidence be shared?
Through restricted approved channels with controlled redaction and custody.
Does Eviquire make an HR finding?
No. It preserves selected evidence and process records for authorized reviewers.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
HR and due-diligence teams
Preserve relevant online material for employment, compliance, fraud, and diligence matters.
See role-specific guidance →
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →