Web-forensics use case
Forensic acquisition of web-based CRM evidence
Eviquire Desktop Expert can support the forensic acquisition of records from a browser-accessible CRM, including a CRM reached through an authorized corporate workstation and VPN. The target must be operable through Eviquire’s integrated forensic browser; Eviquire is not an endpoint-imaging tool and does not acquire evidence directly from a proprietary Windows thick-client application.
What this use case means
Eviquire Desktop Expert can support the forensic acquisition of records from a browser-accessible CRM, including a CRM reached through an authorized corporate workstation and VPN. The target must be operable through Eviquire’s integrated forensic browser; Eviquire is not an endpoint-imaging tool and does not acquire evidence directly from a proprietary Windows thick-client application.
CRM evidence is often spread across account records, activity histories, conversations, attachments, dynamically loaded panels, and generated exports. Authentication, VPN routing, proxies, client certificates, user-specific timezones, pagination, and asynchronous loading can all affect what the investigator sees. The acquisition must preserve the relevant content while explaining the authorized environment and navigation sequence that produced it.
Common situations
When this workflow is useful
- Preserving CRM account, contact, opportunity, ticket, or case records for litigation or an internal investigation
- Documenting activity histories, conversations, user actions, notes, reports, and authorized audit information
- Capturing CRM-generated exports, downloads, and attachments together with their web and acquisition context
Recommended process
A documented acquisition workflow
- Confirm suitability and authority
Verify that the target is a web application, define the authorized CRM tenant, accounts, records, date range, investigator, case reference, and collection boundaries, and exclude unrelated customer or employee information.
- Validate the authorized workstation
Connect the workstation to the required corporate VPN or network, confirm normal CRM access, then verify that the same application is reachable from Eviquire’s integrated browser. Test licensing, configured timestamping services, proxy, SSO, MFA, and certificate requirements before formal collection.
- Configure the acquisition
Create the Eviquire case and acquisition record, document the workstation, operating system, Eviquire version, time and timezone, network route, investigator, CRM, and target URLs, and enable the required session-video and network options.
- Navigate systematically
Authenticate through the approved procedure and preserve enough navigation context to show where each item originated—for example, CRM → account or user → activity history → conversation → specific record.
- Load and acquire relevant content
Expand the authorized histories, conversations, pagination, infinite scrolling, modal dialogs, attachments, and asynchronously loaded records. Confirm that content is displayed before completing its acquisition.
- Preserve exports and integrity records
Where the CRM offers an authorized export or download, preserve both the web representation and native CSV, XLSX, PDF, JSON, ZIP, report, or attachment when appropriate, together with hashes and acquisition records.
- Close, verify, and transfer
Complete and close the case, verify the package, export it with the Portable Viewer for controlled transfer or archiving, and use another authorized Eviquire Desktop Expert installation when a forensic examiner needs to import and review the complete case.
Technical guidance
Conditions that affect a web-based CRM acquisition
Confirm these points during a short pre-acquisition validation on the authorized workstation.
Browser-based scope
A practical suitability test is whether the authorized workstation can operate the CRM in a conventional browser such as Microsoft Edge or Google Chrome. Eviquire should normally be able to reach the same web application when the same network, authentication, proxy, certificate, and application requirements are satisfied.
- Suitable: browser-accessible CRM, including private applications reached through a corporate network or VPN.
- Not suitable: evidence available only inside a proprietary Windows desktop or thick-client application.
- Not an endpoint acquisition: Eviquire does not image disks, acquire arbitrary workstation files, or replace a filesystem forensic tool.
VPN, authentication, and Internet access
The CRM does not need to be publicly accessible. Eviquire uses the connectivity of the authorized workstation, so the expected path can be Eviquire → authorized workstation → corporate VPN or network → CRM web application.
Internet access should also be confirmed for Eviquire licensing and configured external evidence-timestamping services. Enterprise controls such as SSO, MFA, client certificates, and corporate proxies should be tested before the formal acquisition.
- Confirm simultaneous access to the CRM and required Internet services.
- Use the normal authorized authentication procedure.
- Record relevant VPN, proxy, certificate, and account conditions without exposing credentials.
Acquisition-session video
The complete browsing and acquisition session can be recorded to show how the investigator moved between records, expanded content, selected controls, and initiated exports or downloads. Visual click highlighting can make the sequence easier to interpret later.
- Preserve the path from the CRM entry point to the specific record.
- Use the video as a continuous record alongside individual screenshots, pageshots, and artifacts.
- Treat the recording as evidence of what was displayed and done during the session, not as independent proof that the CRM’s historical assertion is true.
Network recording
When Wireshark is installed and permitted on the authorized workstation, Eviquire can preserve packet-level network traffic associated with the acquisition. Without Wireshark, Eviquire can still preserve supported application-layer web and network-session information.
- Eviquire with Wireshark: packet-level network capture.
- Eviquire without Wireshark: supported application-layer session and web context.
- Confirm endpoint-security approval and Wireshark availability before collection when packet evidence is required.
CRM exports, downloads, and attachments
Files downloaded through the CRM during the acquisition can be connected to the session that produced them and preserved with integrity information. Where possible, collect both the displayed CRM record and its native export so reviewers can understand their relationship.
- Typical artifacts include CSV, XLSX, PDF, JSON, ZIP, generated reports, and CRM attachments.
- Document the investigator action that initiated the export or download.
- Do not present files already residing on the workstation as if Eviquire acquired them from the CRM.
Time interpretation and independent review
A CRM may display time according to the authenticated user profile, organization configuration, browser or system timezone, or server-side settings. Record the acquisition workstation’s time and timezone and, when timestamps matter, document the CRM’s configured timezone as well.
After case closure, the preserved package can be transferred for review through the Portable Viewer or imported into another authorized Eviquire Desktop Expert installation. Preserve the exported package as the original evidential record and perform later analysis without altering its acquired artifacts.
- Distinguish the time of acquisition from the historical time asserted by the CRM.
- Correlate important events with CRM audit logs, identity logs, application logs, or server-side records when independent validation is required.
- Verify integrity and maintain chain-of-custody records during transfer, archiving, and review.
Reviewable output
What the evidence package should explain
CRM presentation and navigation
Pages, records, conversations, activity histories, screenshots, pageshots, URLs, and session video show what the authenticated CRM presented and how the investigator reached it.
Network and environment context
Workstation and software information, time and timezone, network or VPN conditions, supported application-layer context, and optional packet capture document the acquisition environment.
Native files and integrity records
Authorized CRM exports, reports, downloads, and attachments can be preserved with cryptographic hashes, timestamps, and their relationship to the acquisition session.
Portable review package
The closed case, activity and custody records, reports, and Portable Viewer support controlled transfer, independent review, and import into another authorized Eviquire instance.
The exact artifacts depend on the source, plan, configuration, authority, and investigation. A report should identify what was and was not collected.
Professional considerations
Authority, proportionality, and limitations
- Collect only records within the authorized scope and minimize unrelated customer, employee, commercially sensitive, privileged, or regulated data.
- A CRM acquisition preserves what the authenticated application presented during collection; it does not independently prove that a displayed historical event occurred as stated.
- Record failed, unavailable, unloaded, filtered, paginated, or permission-restricted content rather than implying that the acquisition represents the entire CRM dataset.
- Coordinate temporary installation, Wireshark, VPN, proxy, endpoint security, credentials, MFA, retention, transfer, and removal of the acquisition environment with the client’s approved procedure.
Important: Eviquire supports a documented technical process. It does not establish identity, truth, culpability, infringement, or admissibility, and it does not replace legal advice or a validated organizational procedure.
Standards and primary guidance
Online evidence procedures should be validated for the organization and matter. Useful starting points include SWGDE guidance for acquiring online content, ISO/IEC 27037:2012, and NIST digital-evidence resources.
Frequently asked questions
Can Eviquire acquire evidence from a CRM available only through a corporate VPN?
Yes, provided the authorized workstation can reach the browser-based CRM through the VPN and Eviquire’s integrated browser can satisfy the same network, authentication, proxy, and certificate requirements. The CRM does not need to be publicly accessible.
Can Eviquire acquire a proprietary desktop CRM application?
Not directly. Eviquire is designed for web-evidence acquisition, not endpoint imaging or direct acquisition from a Windows thick-client application. The target CRM must expose the relevant evidence through a browser-accessible web interface.
Is Wireshark required?
Wireshark is required when packet-level network capture is needed. Without Wireshark, Eviquire can still preserve supported application-layer web and network-session information together with the visible evidence and acquisition record.
Can CRM exports and attachments be preserved?
Yes, when they are obtained through an authorized web-based download or export during the Eviquire session. Preserve the web context, investigator action, original downloaded file, and its cryptographic hash.
Does Eviquire validate that a CRM event actually happened at the displayed time?
No. Eviquire can preserve evidence that the authenticated CRM displayed the event and timestamp during acquisition. Independent validation may require CRM audit logs, identity logs, application logs, database records, or other authoritative sources.
Can another examiner review the case away from the client workstation?
Yes. After closure and integrity verification, the case can be exported with the Portable Viewer for controlled independent review or imported into another authorized Eviquire Desktop Expert installation while preserving the original evidence package.
Why is Internet access needed during acquisition?
The workstation should normally be able to reach the required Eviquire licensing infrastructure and any configured external evidence-timestamping services while also retaining access to the CRM through the corporate network or VPN.
Who uses this workflow?
Relevant professional roles
This acquisition workflow is commonly relevant to these teams. The appropriate authority, scope, procedure, and review requirements still depend on the matter.
Forensic experts
Acquire online evidence with technical context, integrity verification, custody records, and reporting.
See role-specific guidance →
HR and due-diligence teams
Preserve relevant online material for employment, compliance, fraud, and diligence matters.
See role-specific guidance →
Law enforcement
Preserve volatile online evidence for authorized criminal and intelligence investigations.
See role-specific guidance →
Law firms
Preserve websites and online content for litigation, disclosure, legal holds, and expert review.
See role-specific guidance →