CRM Evidence Salesforce HubSpot

CRMEVIDENCE · AGUIDEFORUKLAWYERS CRM Evidence: Salesforce, HubSpot and Customer Systems Pipelines, Field Histories and the System That Watched the Relationship COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the system that watched the relationship 03 Anatomy: objects, activities and the notes layer 04 Histories and logs across the platforms 05 Exports, reports and the exfiltration record 06 Deletion, recycle bins and recovery 07 Collection routes and pipeline analysis 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THECRMRECORDSTHERELATIONSHIPAND , SEPARATELY , RECORDSWHOTOUCHEDTHERECORD : DEPARTING - EMPLOYEECASESAREUSUALLY DECIDEDINTHESECONDLAYER § 0 2 · FIRSTPRINCIPLES The problem in plain English: the system that watched the relationship § 0 3 · ANATOMY Anatomy: objects, activities and the notes layer OBJECT / LAYER WHAT IT HOLDS · WHY IT MATTERS § 0 4 · THEHISTORIES Histories and logs across the platforms § 0 5 · THEWAYOUT Exports, reports and the exfiltration record 54 and 111 finish it. § 0 6 · GONE , ANDBACK Deletion, recycle bins and recovery § 0 7 · GETTINGITANDREADINGIT Collection routes and pipeline analysis § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BIN / MIRROR LIVE HISTORIES & BACKUPS / DELETED / ORG LOGS SANDBOXES RECOVERABLE RECYCLE INTEGRATED & ARCHIVES SYSTEMS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEEXPORTAT22 : 1 EXAMPLE2 · THEREASSIGNMENTSTHATPRE - DATEDTHEPLAN EXAMPLE3 · THERECYCLEBINANDTHESANDBOX § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · CRMLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The CRM checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can we see if a departing employee downloaded our client list? Are CRM notes really disclosable? Our sales team wrote them assuming privacy. The opponent produced a spreadsheet of "the relevant CRM records". Sufficient? Our client's org only keeps login history for a few months and it has already rotated. Now what? The suspect was an admin. Could they have covered their tracks? Can pipeline data prove solicitation, or only opportunity? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY