Web-forensics use case
Acquire utilities and telecommunications portal evidence
Eviquire can preserve authorized utility and telecommunications account information presented through a browser, including account and service context, configuration, usage, bills, outages, support interactions, orders, line or device information and downloadable statements. It records the customer or administrator portal presentation, not raw metering, network, switch, provider database or device evidence.
What this use case means
Eviquire can preserve authorized utility and telecommunications account information presented through a browser, including account and service context, configuration, usage, bills, outages, support interactions, orders, line or device information and downloadable statements. It records the customer or administrator portal presentation, not raw metering, network, switch, provider database or device evidence.
Usage and billing portals aggregate data from metering, rating, network and support systems and may display estimates, delayed events or account-local time. One account can contain several premises, meters, lines or devices. Evidence must connect each record to the correct service identifier, period, unit, tariff, timezone and account role.
Common situations
When this workflow is useful
- Billing, usage, outage, service, fraud, subscriber, employment or regulatory disputes
- Preserving account and service history before correction or closure
- Documenting what an authorized customer, enterprise or support role could see
Recommended process
A documented acquisition workflow
- Define service scope
Identify provider, account, premises, lines, meters or devices, periods, units, tariffs and exclusions.
- Record portal configuration
Preserve role, locale, timezone, billing cycle, service identifiers and navigation.
- Acquire relevant chronology
Document service state, usage, billing, outages, orders, devices and support interactions in context.
- Preserve supplied records
Download authorized bills, statements, usage reports, contracts and support exports.
- Correlate underlying data
Hash files and compare disputed readings, calls, sessions or outages with provider and device records.
Technical guidance
Conditions that affect utility and telecom evidence
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Estimated and delayed data
Usage may be estimated, aggregated, rounded or posted after the event.
- Record units and status labels.
- Capture billing and usage periods.
- Preserve corrected values separately.
Multiple services and identifiers
Accounts can contain several premises, meters, numbers, SIMs, devices and contracts.
- Record the selected identifier.
- Preserve hierarchy and navigation.
- Avoid mixing services.
Subscriber confidentiality
Portals expose addresses, calling or usage patterns, identifiers and financial records.
- Collect narrowly.
- Restrict access.
- Redact disclosure copies.
Reviewable output
What the evidence package should explain
Service context
Provider, account role, premise or line, device or meter, period, tariff and timezone.
Displayed service record
Usage, billing, outages, orders, devices and support chronology.
Supplied documents
Authorized bills, statements, reports and contracts preserved with hashes.
Review package
Session activity, data limitations, timestamps and custody history.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Subscriber and location data can be highly sensitive and legally protected.
- Portal readings and usage summaries may be estimated or transformed.
- Do not alter service, device, billing or support settings during acquisition.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Does portal usage equal raw meter or network data?
Not necessarily. It may be aggregated, delayed or estimated.
Can bills and statements be preserved?
Yes when authorized, in supplied formats with hashes.
Why record the service identifier?
One account may contain multiple lines, premises or devices.
Can outage history be captured?
Yes when the portal displays it, with time and status limitations.
Does Eviquire acquire telecom network logs?
No. Provider or network acquisition is separate.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →