Web-forensics use case
Acquire evidence from learning and examination portals
Eviquire can preserve authorized records presented by a browser-based learning or examination portal, including enrolment, course and assessment context, submissions, attempt and grade presentation, feedback, communications, certificates and visible activity history. It is not a direct acquisition of the learning database, proctoring backend, student device or institution’s authoritative academic record.
What this use case means
Eviquire can preserve authorized records presented by a browser-based learning or examination portal, including enrolment, course and assessment context, submissions, attempt and grade presentation, feedback, communications, certificates and visible activity history. It is not a direct acquisition of the learning database, proctoring backend, student device or institution’s authoritative academic record.
Learning platforms show different information to students, instructors, graders and administrators. Attempts may be timed, randomized or locked after viewing, grades can be recalculated, and proctoring material may reside in a separate service. The acquisition must avoid starting or altering an assessment and clearly record role, course, version, attempt and timezone.
Common situations
When this workflow is useful
- Academic, certification, employment, misconduct, accessibility or contractual disputes
- Preserving submissions, results, feedback or certificates before access or retention changes
- Documenting what a student, instructor or administrator role could see
Recommended process
A documented acquisition workflow
- Define educational scope
Identify institution, course, learner, assessment, attempt, dates, records and protected exclusions.
- Document role and course state
Record tenant, role, enrolment, course version, locale, timezone and navigation.
- Acquire relevant records
Preserve assessment overview, attempt history, submission, grading, feedback, messages, activity and certificate context without initiating a new attempt.
- Download authorized files
Preserve submissions, feedback, certificates and reports in supplied formats.
- Qualify and transfer
Hash artifacts, state randomized or inaccessible content, and correlate disputed results with institutional records.
Technical guidance
Conditions that affect learning-portal acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Attempts and state changes
Opening an assessment can begin a timer, consume an attempt or alter completion state.
- Use review views.
- Avoid start and submit controls.
- Record unavoidable state changes.
Role and version
Students and staff see different questions, grades, overrides and activity; content can be randomized or versioned.
- Record role and course version.
- Identify attempt number.
- Do not infer hidden records are absent.
Proctoring and identity
Identity checks, video and device telemetry may belong to another service and raise substantial privacy issues.
- Acquire only under specific authority.
- Keep portal presentation distinct from proctoring evidence.
- Corroborate important identity claims.
Reviewable output
What the evidence package should explain
Academic context
Institution, course, assessment, role, attempt, version, timezone and navigation.
Learning record
Displayed questions where authorized, submission, grade, feedback, messages and activity.
Native files
Authorized submissions, certificates and reports preserved with hashes.
Custody package
Session history, timestamps, limitations and controlled transfer.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Student records, disability accommodations and proctoring data require strict legal and institutional controls.
- Displayed grades and identities are not substitutes for certified institutional records.
- Do not start, submit, reset, grade or modify an assessment unless expressly authorized.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire acquire an online exam?
It can preserve authorized reviewable content without bypassing controls; active attempts require particular care.
Can opening an exam change it?
Yes. It may start a timer or consume an attempt, so use an authorized review view.
Are grades authoritative?
The portal presentation is evidence; certified institutional records may be required.
Can certificates be preserved?
Yes, along with their portal context and supplied file hashes.
Does Eviquire acquire proctoring video?
Only if lawfully exposed through a compatible authorized web interface; provider acquisition may be more appropriate.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →
HR and due-diligence teams
Preserve relevant online material for employment, compliance, fraud, and diligence matters.
See role-specific guidance →