In mergers and acquisitions, the technical question comes before signing: what the other party has, what it did not disclose and who answers for what has already happened.
An M&A transaction rests on representations about systems, data and people. Some of them can be verified before signing, in the company's devices, e-mails and records. Technical due diligence makes that verification with the forensic method: preservation, hash, chain of custody and conclusions limited to what the evidence shows.
The result serves those deciding on the transaction. And it serves again if the deal turns into a dispute after closing, because the evidence was born intact.
Examination of executives' computers and phones to identify relationships that could compromise the transaction, with keyword searches of e-mail defined in advance.
Has the target company already suffered a data incident it did not report? Access logs, privileged accounts and signs of exfiltration answer before closing, when the answer still changes the price.
Ownership and quality of the code, licences of third-party components and critical dependencies. The examination checks whether the software the company says it owns is really its own and works as declared.
When part of the price depends on targets measured in systems, the dispute turns on data integrity: ERP and CRM audit trails, database extractions, commit history, access and conversion metrics. The examination says whether the data entering the calculation is intact and who entered or altered it. The financial calculation remains with the forensic accountant.
A former partner or executive who takes the customer base, code or documents, including in disputes over the expulsion of a partner. The examination shows when the copy was made, by what means it left and where it went.
Disputed handwritten signatures, electronic signatures with a questioned audit trail, digital meeting minutes with disputed attendance or voting. Adriano Vallim works both in forensic handwriting examination and in digital document examination.
When an incident hits an environment that is changing hands, the dispute stops being purely technical. Who answers to the data subjects, to the ANPD and to the other party? A controller or processor that causes damage in breach of data protection legislation is required to repair it (LGPD, Brazil's data protection act, art. 42), and so it matters whose system was hit, and on what date.
The answer depends on preservation done before remediation. In a real case, dozens of terabytes were preserved to separate the inherited systems from the systems of the new operation. With dated evidence, the examination shows where the access came in, in which system and in which period, and the discussion of who answers gains a technical basis.
Challenge. In a merger, the board needed to know whether any executive maintained relationships that could compromise the transaction.
Method. The examination looked at the executives' computers and phones and searched all e-mails for keywords established in advance, recording the origin and integrity of each message located.
Outcome. The board received the findings with chain of custody, fit to support the decision on the transaction and any later dispute.
See also
LGPD, ANPD and Data Breach Forensics → Corporate Investigations and Compliance → Intellectual Property, Trade Secrets and Unfair Competition → Software and Development Project Forensics → Information Security and Compliance → Forensic Handwriting and Questioned Document Examination → Electronic Signatures and Digital Contracts →