Web-forensics use case
Acquire travel and booking portal evidence
Eviquire can preserve authorized travel and booking information presented through a browser, including reservation and itinerary context, passenger or guest presentation, modifications, payment and refund status, messages, loyalty activity and downloadable confirmations. It does not directly acquire airline, hotel, border, payment or booking-provider backend systems.
What this use case means
Eviquire can preserve authorized travel and booking information presented through a browser, including reservation and itinerary context, passenger or guest presentation, modifications, payment and refund status, messages, loyalty activity and downloadable confirmations. It does not directly acquire airline, hotel, border, payment or booking-provider backend systems.
Travel records cross providers, currencies and timezones and can be reissued after changes. Local and scheduled times, booking creation times and portal update times answer different questions. A sound acquisition connects the displayed itinerary to its booking reference, account role, traveler presentation, segment, fare or room conditions and supplied documents.
Common situations
When this workflow is useful
- Travel, refund, insurance, employment, fraud, expense or location disputes
- Preserving a reservation before cancellation, reissue or account closure
- Documenting the itinerary and documents an authorized traveler or administrator could access
Recommended process
A documented acquisition workflow
- Define reservation scope
Identify booking references, travelers, segments, dates, documents, payment issues and unrelated data to exclude.
- Record portal configuration
Preserve provider, account role, locale, currency, timezone and navigation route.
- Acquire itinerary and history
Document reservation status, segment details, modifications, messages, fees, refund and loyalty presentation.
- Preserve supplied confirmations
Download authorized tickets, vouchers, receipts, invoices and itinerary exports in supplied formats.
- Correlate important events
Hash originals and compare disputed travel or payment facts with provider, border, payment or employer records.
Technical guidance
Conditions that affect travel-portal evidence
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Multiple times and zones
Departure, arrival, booking, change and display times can use different zones and daylight-saving rules.
- Record labels and zones.
- Preserve local dates exactly.
- Distinguish scheduled from actual times.
Reissued records
Changes may create new ticket, voucher or reservation documents while old details disappear.
- Capture history where shown.
- Preserve each supplied version.
- Record document numbers carefully.
Identity and payment data
Travel portals expose passports, dates of birth, addresses, loyalty and payment information.
- Collect only necessary fields.
- Protect originals.
- Redact review copies.
Reviewable output
What the evidence package should explain
Booking context
Provider, reference, role, traveler or guest, segments, locale, currency and timezone.
Travel chronology
Status, modifications, messages, charges, refunds and loyalty presentation.
Supplied documents
Tickets, vouchers, receipts and itineraries preserved with hashes.
Review record
Session activity, timestamps, limitations and custody history.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Travel records contain identity, location and financial data and may affect vulnerable persons.
- Portal itinerary presentation does not independently prove physical travel.
- Keep payment, immigration, employer and provider sources separate and properly authorized.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Does a booking prove that someone travelled?
No. It documents a reservation; travel may require carrier, border or other corroboration.
How should timezones be handled?
Record each displayed time and timezone and distinguish scheduled, actual and acquisition time.
Can tickets and vouchers be preserved?
Yes when authorized, as supplied files with hashes.
What if a booking was reissued?
Preserve each available version and its identifiers and history.
Can loyalty data be acquired?
Only when relevant, authorized and proportionate.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →