Page 1
ERPEVIDENCE · A GUIDE FOR UK LAWYERS ERP Evidence: SAP, Oracle and Enterprise Systems Purchase-to-Pay, Change Documents and the System of Record at Enterprise Scale COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CHANGE-DOCUMENT & WORKFLOW ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the machine that runs the company 03 Anatomy: modules, documents and the flow 04 Change documents, audit logs and the history layer 05 Approvals, workflows and author is at i on evidence 06 Scoping and extraction at enterprise scale 07 Patterns: procurement fraud, warranty and supply-chain disputes 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THEERPLINKSEVERYDISPUTEDTRANSACTIONINTOA DOCUMENTEDFLOWWITHACHANGEHISTORY: FOLLOWTHEFLOW, READTHECHANGES, TESTTHEAPPROVALS
§ 02 · FIRST PRINCIPLES The problem in plain English: the machine that runs the company
§ 03 · ANATOMY Anatomy: modules, documents and the flow
Page 2
§ 04 · THEHISTORYLAYER Change documents, audit logs and the history layer
§ 05 · WHO COULD, WHODID Approvals, workflows and author is at i on evidence
§ 06 · SCALE Scoping and extraction at enterprise scale
§ 07 · THEPATTERNS Patterns: procurement fraud, warranty and supply-chain disputes
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE TEST PRODUCTION ARCHIVE S / WAREHOUSE / BANKS & DELETED / SYSTEM BACKUPS REPORTING COUNTERPARTIES RECOVERABLE COPIES
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEBANKDETAILSTHATCHANGEDFORNINEDAYS EXAMPLE2 · THE THREE - WAYMATCHTHATNEVERHAPPENED EXAMPLE3 · THETWOERPSTHATAGREEDAGAINSTTHEPLEADING
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · ERPLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The ERP checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can we really get evidence out of something as vast as SAP? What is a change document, in one paragraph? The opponent says extraction would cost a fortune and disrupt production. Genuine? Who actually did it, when the system only shows a user ID? The relevant years have been archived off the live system. Problem? Our supply dispute is really about what physically shipped. Can the ERP say?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, ERP Evidence SAP Oracle, Computer Forensics Lab, https://e-discovery.uk/library/erp-evidence-sap-oracle/pdf.