Question 1

Can we see if a departing employee downloaded our client list?

Accepted Answer

Often, and quickly: export and report logs (where the edition keeps them) record the pull directly; report definitions show what was built to be pulled; login histories bracket the sessions; and the file's afterlife runs guide 41's device-and-cloud chain. The honest caveat is §5's: orgs without event monitoring may not log exports, in which case the answer comes from the periphery: device artefacts, personal-email trails, and the competitor's suspicious reach: rather than the platform. Are CRM notes really disclosable? Our sales team wrote them assuming privacy. Fully: they are business records within the party's control, and their unguarded tone is precisely their evidential value: no privacy expectation attaches to a company system's contents in disclosure. The practice point runs both ways: collect the opponent's notes at full fidelity, and advise your own clients: prospectively: that the CRM is a disclosure source, because "wants us wherever I land" reads very differently in a bundle than it did in a pipeline review.

Question 2

The opponent produced a spreadsheet of "the relevant CRM records". Sufficient?

Accepted Answer

Almost never: it is guide 71's report-not-record problem: a current-state extract without histories, logs or the dictionary, shaped by unstated filters. The §11 questions ask for the platform's own layers: field histories, login and export logs, bin contents, the edition and retention facts: and a production that resists the history layer while offering the story is answer in g the wrong question, which is itself worth point in g out to the court.

Question 3

Our client's org only keeps login history for a few months and it has already rotated. Now what?

Accepted Answer

Work the map of §8: backups and sandbox refreshes preserve point-in-time states; integration mirrors (synced calendars, email, marketing platforms) hold the activities' independent copies; device-side artefacts date sessions the platform forgot; and the correspondence estate dates intent regardless. Rotation costs precision, not the case: and prospectively, the lesson is the standing one: freeze and export the short-lived layers in the first week, every time.

Question 4

The suspect was an admin. Could they have covered their tracks?

Accepted Answer

Partially at best: admins can delete records and some time s adjust configurations, but administrative acts land in setup audit trails, deletions transit recycle bins with windows, histories resist retrospective editing, backups and sandboxes hold prior states, and mirror systems never answered to them at all: Example 3's rebuild ran through exactly these layers. The exam in at i on checks trail integrity first (guide 72 §4's rule), and an admin's clean-up attempt usually adds a conduct chapter rather than removing one.

Question 5

Can pipeline data prove solicitation, or only opportunity?

Accepted Answer

By itself it proves patterns: cadence, moves, timing: which is opportunity and preparation; solicitation usually needs the join: the CRM chronology interleaved with the messages (guide 70) where the approach itself lives, the counterpart layer (the client's side of the story, per guides 63-65), and the aftermath data (deals resurfacing at the competitor). The CRM supplies the skeleton and the dates; the estate supplies the words: which is why the pipeline chronology is built as an interleaved deliverable, not a standalone chart. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

CRM Evidence Salesforce HubSpot