ERP Evidence SAP Oracle

ERPEVIDENCE · AGUIDEFORUKLAWYERS ERP Evidence: SAP, Oracle and Enterprise Systems Purchase-to-Pay, Change Documents and the System of Record at Enterprise Scale COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM CHANGE-DOCUMENT & WORKFLOW ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the machine that runs the company 03 Anatomy: modules, documents and the flow 04 Change documents, audit logs and the history layer 05 Approvals, workflows and authorisation evidence 06 Scoping and extraction at enterprise scale 07 Patterns: procurement fraud, warranty and supply-chain disputes 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THEERPLINKSEVERYDISPUTEDTRANSACTIONINTOA DOCUMENTEDFLOWWITHACHANGEHISTORY : FOLLOWTHEFLOW , READTHECHANGES , TESTTHEAPPROVALS § 0 2 · FIRSTPRINCIPLES The problem in plain English: the machine that runs the company § 0 3 · ANATOMY Anatomy: modules, documents and the flow § 0 4 · THEHISTORYLAYER Change documents, audit logs and the history layer § 0 5 · WHOCOULD , WHODID Approvals, workflows and authorisation evidence § 0 6 · SCALE Scoping and extraction at enterprise scale § 0 7 · THEPATTERNS Patterns: procurement fraud, warranty and supply-chain disputes § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE TEST PRODUCTION ARCHIVES / WAREHOUSE / BANKS & DELETED / SYSTEM BACKUPS REPORTING COUNTERPARTIES RECOVERABLE COPIES § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEBANKDETAILSTHATCHANGEDFORNINEDAYS EXAMPLE2 · THETHREE - WAYMATCHTHATNEVERHAPPENED EXAMPLE3 · THETWOERPSTHATAGREEDAGAINSTTHEPLEADING § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · ERPLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The ERP checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can we really get evidence out of something as vast as SAP? What is a change document, in one paragraph? The opponent says extraction would cost a fortune and disrupt production. Genuine? Who actually did it, when the system only shows a user ID? The relevant years have been archived off the live system. Problem? Our supply dispute is really about what physically shipped. Can the ERP say? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY