Web-forensics use case
Acquire evidence from virtual data rooms
Eviquire can document authorized content presented through a browser-based virtual data room, including room and folder structure, document identity, version and watermark presentation, permissions, Q&A, visible activity, controlled downloads, and acquisition records. It does not override view-only restrictions or replace provider audit, administrator export, API, or backend acquisition.
What this use case means
Eviquire can document authorized content presented through a browser-based virtual data room, including room and folder structure, document identity, version and watermark presentation, permissions, Q&A, visible activity, controlled downloads, and acquisition records. It does not override view-only restrictions or replace provider audit, administrator export, API, or backend acquisition.
Data rooms deliberately restrict viewing, printing, downloading, and disclosure. Dynamic viewers can watermark content, prevent native downloads, or render pages differently for each user. Evidence collection must respect contractual and technical controls while recording the room, folder, document, version, permission state, and any authorized export.
Common situations
When this workflow is useful
- Transaction, dispute, audit, regulatory, insolvency, or due-diligence review
- Preserving a disclosed document, Q&A response, permission state, or version before the room changes
- Documenting exactly what an authorized reviewer could see during a defined access period
Recommended process
A documented acquisition workflow
- Confirm contractual and legal authority
Define room, account, folders, documents, versions, disclosure restrictions, permitted captures, downloads, and recipients.
- Document access state
Record room and project name, user role, permission and watermark presentation, time, timezone, network, and authentication conditions.
- Acquire structured context
Navigate from room to folder and document, preserve index and metadata, relevant Q&A or activity, and the rendered pages necessary to explain the source.
- Preserve allowed exports
Download only authorized files, retain supplied names and formats, hash originals, document view-only limitations, and transfer the closed case under strict custody controls.
Technical guidance
Conditions that affect virtual-data-room acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
View-only and watermark controls
The portal may personalize watermarks and restrict capture, printing, or download according to agreement and role.
- Do not bypass controls.
- Record the visible watermark and permission state.
- Document why a native file was unavailable.
Versions and disclosure structure
Folder indexes, versions, Q&A, and activity views can change throughout a transaction or review.
- Identify the selected version.
- Preserve the folder path and document identifier.
- Record the acquisition time and room state.
Independent review
A preserved portal presentation may contain confidential transaction material and personalized identifiers.
- Restrict access and disclosure.
- Keep originals unchanged.
- Use provider audit or administrator exports when authoritative access history is required.
Reviewable output
What the evidence package should explain
Room structure
Room, folder path, document identity, version, and navigation.
Access presentation
Permissions, watermark, Q&A, visible activity, and viewer conditions.
Authorized documents
Native downloads or generated exports with hashes and format details.
Controlled package
Session history, timestamps, reports, limitations, and custody records.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Follow data-room terms, confidentiality agreements, legal authority, clean-team rules, and disclosure restrictions.
- Eviquire must not be used to defeat technical controls or acquire material beyond the authorized account.
- Portal evidence of access or permission should be corroborated with provider audit records when disputed.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire bypass a download restriction?
No. Collection must respect the portal controls and authorization.
Can watermarks be preserved?
Yes, as presented in the authorized viewer or export.
Is a rendered page the native document?
No. Preserve an authorized native download separately when available.
Can access history be proven from the portal?
The visible activity can be preserved, but authoritative history may require provider records.
How should the case be shared?
Use restricted, approved transfer and review procedures consistent with the room’s confidentiality obligations.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →In-house legal teams
Preserve early evidence for disputes, compliance, legal holds, and outside-counsel review.
See role-specific guidance →