Web-forensics use case
Acquire evidence from insurance claims portals
Eviquire can document authorized insurance-claim information presented through a web portal, including claim and policy context, parties, status and assignment history, communications, adjuster notes where permitted, uploaded evidence, decisions, payment information and generated exports. It is not a direct acquisition of the insurer’s claims database, underwriting system, medical records or provider audit backend.
What this use case means
Eviquire can document authorized insurance-claim information presented through a web portal, including claim and policy context, parties, status and assignment history, communications, adjuster notes where permitted, uploaded evidence, decisions, payment information and generated exports. It is not a direct acquisition of the insurer’s claims database, underwriting system, medical records or provider audit backend.
A claim evolves across customer, adjuster, supervisor, repair, medical, legal and payment views. Role-based permissions and automation can hide notes or update status while collection is underway. The acquisition must connect each relevant record to the claim identifier, policy, party, source panel, displayed time and account role while excluding unrelated sensitive data.
Common situations
When this workflow is useful
- Coverage, liability, fraud, valuation, delay, complaint or bad-faith disputes
- Internal or regulatory review of claim handling and communications
- Preserving a claim presentation before closure, reassignment, retention or portal access changes
Recommended process
A documented acquisition workflow
- Set claim scope
Identify claim and policy numbers, parties, time range, document categories, privileged material, medical information and exclusions.
- Document account visibility
Record organization, portal, account role, assigned permissions, locale, timezone and how the claim was located.
- Acquire the claim chronology
Navigate through status, assignments, communications, notes, decisions, tasks, payments and linked records, expanding only relevant panels.
- Preserve submitted and generated files
Download authorized evidence, letters, estimates, reports and exports in supplied formats and record their relationship to the claim.
- Close and reconcile
Hash originals, record unavailable or hidden material, compare portal times carefully, and transfer under restricted custody.
Technical guidance
Conditions that affect claims-portal acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Role and privilege
Claimants, brokers, adjusters, counsel and administrators may see materially different notes and documents.
- Record the role and effective permissions.
- Segregate privileged material.
- Do not infer hidden records are absent.
Mutable workflow
Viewing, assigning, commenting or downloading can create events or trigger automated status changes.
- Avoid operational controls.
- Record starting and ending state.
- Explain investigator-generated activity.
Sensitive linked sources
Medical, repair, police, payment and identity documents may be linked from separate services.
- Acquire only under matching authority.
- Preserve native files separately.
- Apply strict access, retention and redaction controls.
Reviewable output
What the evidence package should explain
Claim identity
Portal, claim and policy references, parties, account role and navigation path.
Handling chronology
Displayed status, assignment, communications, notes, decisions, tasks and payment history.
Claim files
Authorized submissions, estimates, correspondence, reports and exports with hashes.
Custody package
Session record, timestamps, limitations, reports and controlled transfer history.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Claims commonly contain health, financial, identity and third-party information; collect proportionately.
- Portal evidence records what the authorized role saw, not the complete insurer record or truth of the underlying event.
- Keep legal conclusions about coverage, fraud, liability and claim handling separate from the acquisition record.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire acquire an insurer’s complete claim file?
Only content exposed to the authorized browser account; database and backend sources require other methods.
Can adjuster notes be preserved?
Yes when the account, authority and scope permit access.
Should uploaded evidence be downloaded?
Preserve relevant authorized originals separately and hash them.
Can portal activity change a claim?
Some actions can. Avoid operational controls and record any effects.
Does the portal establish liability or fraud?
No. It preserves displayed records; those conclusions require investigation and analysis.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →
Private investigators
Turn online findings into organized, verifiable evidence and professional client reports.
See role-specific guidance →