SaaS Platforms As Undiscovered Repositories

SAASDISCOVERY · AGUIDEFORUKLAWYERS SaaS Platforms as Undiscovered Repositories Finding, Preserving and Collecting the Business Records That Live Inside Applications COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the record moved into the app 03 Finding the platforms: mapping the SaaS estate a business actually uses 04 What each kind holds: CRM, project, HR, support, finance and messaging 05 The structured record: fields, history, comments and audit trails 06 Preservation and collection: holds, exports, APIs and the format problem 07 Deployment: disclosure obligations, proportionality and the audit trail's power 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : BUSINESSRECORDSINCREASINGLYLIVEINSIDESAAS APPLICATIONSTHATNOEMAIL - AND - DRIVESDISCLOSUREEXERCISEWILLFIND : MAP THEESTATEFROMENDPOINTS , NETWORKANDEXPENSES ; PRESERVEEACHPLATFORM AGAINSTITSOWNRETENTION ; ANDCOLLECTITSSTRUCTUREDRECORDSANDAUDIT TRAILS , WHICHFREQUENTLYANSWERTHECASEMOREDIRECTLYTHANANYDOCUMENT § 0 2 · FIRSTPRINCIPLES The problem in plain English: the record moved into the app § 0 3 · FINDINGTHEPLATFORMS Finding the platforms: mapping the SaaS estate a business actually uses § 0 4 · WHATEACHKINDHOLDS What each kind holds: CRM, project, HR, support, finance and messaging § 0 5 · THESTRUCTUREDRECORD The structured record: fields, history, comments and audit trails § 0 6 · PRESERVATIONANDCOLLECTION Preservation and collection: holds, exports, APIs and the format problem § 0 7 · DEPLOYMENT Deployment: disclosure obligations, proportionality and the audit trail's power § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION PLATFORM COUNTERPARTIES THE ITSELF INTEGRATION ENDPOINT IDENTIT Y + PROVIDER REFLECTIONS TRACES NETWORK RECORDS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THECUSTODIANWITHNODOCUMENTSANDACRMFULLOFTHEM EXAMPLE2 · THEPROJECTTOOLTHATHELDTHEREALCHRONOLOGY EXAMPLE3 · THEPROPORTIONATECOLLECTIONTHATAVOIDEDTHEWHOLESALEONE § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider PROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The SaaS-discovery checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions A key witness says they have almost no relevant documents. Is that the end of it? How do we even find out what SaaS platforms a business uses? Can data in a CRM or project tool really be collected for disclosure? What makes the audit trail so useful? The other side wants "all our HR system data". Do we have to extract everything? What if a record was changed or deleted in the app? § 1 4 · REFERENCE Glossary CRM SSO Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY