Structured Data and Database Discovery
Forensic analysis and defensible extraction from enterprise databases, ERP systems, CRM platforms, and financial applications. Schema-aware methodology that preserves context, relationships, and meaning for New York commercial litigation, regulatory proceedings, and employment disputes.
What This Solves
The opposing party runs SAP. The relevant data is not in an email folder or a document library. It lives across dozens of relational tables, linked by foreign keys, filtered by application logic, and displayed to users through views that assemble records on the fly. Exporting those tables in bulk gives you raw field values with no context: the numbers do not make sense without the schema, and the schema does not make sense without knowing which stored procedures assembled the report your client relied on in the transaction at issue.
This is the problem structured data discovery addresses. When New York commercial litigation involves an ERP system, a financial database, a healthcare record platform, or a custom CRM, collecting the relevant data requires understanding the system before writing a single extraction query. NYCF's forensic analysts work directly with your database administrators, application vendors, and technical stakeholders to extract exactly what the matter requires, in a form that reviewers can use, with a methodology that survives challenge in SDNY, EDNY, and NY Commercial Division proceedings.
New York presents particular concentrations of database-intensive matters. Financial services litigation in the SDNY frequently involves Oracle, Bloomberg, or proprietary trading system databases. Employment disputes at large New York employers often turn on records in Workday or PeopleSoft HR systems. Real estate and construction disputes may involve project accounting systems built on SAP or Oracle. Healthcare matters at NY-area hospital systems implicate Epic and Cerner records. NYCF's structured data practice is built around these specific environments.
Why Databases Cannot Be Treated Like Files
The Sedona Conference has addressed structured data handling directly, noting that databases present unique challenges that standard document collection workflows do not resolve. A single "document" in an ERP system may span ten related tables. A sales transaction record in Oracle, for instance, draws from the customer master, the item catalog, the pricing engine, the warehouse allocation tables, and the accounts receivable ledger before any report is generated. Export the raw tables without that context and you have data, but you do not have information.
Several issues make database discovery genuinely distinct from file or email collection. Field labels in one system may carry completely different meaning in another deployment of the same software, because organizations customize field names and repurpose columns for their own workflows. Deleted records often leave artifacts in audit tables, change logs, or transaction journals that are only accessible if you know where to look. Calculated fields, derived values, and report summaries exist only at query execution time: they cannot be collected as a static file, because the query logic itself must be preserved and reproduced. Multi-tenant configurations mean that data from different business units may share the same physical tables but be separated only by a company code or tenant identifier, which must be scoped correctly in every extraction query to avoid over-collection or under-collection.
NYCF's database forensics practice is built around these realities. Every engagement begins with understanding the system architecture, not with running queries.
Enterprise Systems NYCF Supports
NYCF has performed structured data analysis and forensic extraction from a wide range of enterprise platforms commonly found in New York-headquartered organizations. Each requires a different approach based on its data model, access controls, and application logic.
Oracle E-Business Suite and Oracle Database: Financial ledgers, supply chain modules, HR records, and custom application schemas. NYCF handles multi-org configurations and identifies relevant audit trail tables including FND_LOGINS and Oracle audit change tracking structures. Common in large New York financial institutions and consumer goods companies.
SAP ERP (ECC, S/4HANA): Complex table structures including BKPF/BSEG for financial postings, VBAK/VBAP for sales orders, and change document tables (CDHDR/CDPOS) that record field-level modifications with timestamps and user IDs. SAP deployments are standard across the largest New York manufacturing, retail, and financial services organizations.
Salesforce: Object-level data including standard and custom objects, field history tracking tables, and the audit trail logging administrative changes across the tenant. NYCF collects via the Salesforce API with metadata preservation, not manual CSV export. Salesforce records are frequently relevant in New York commercial disputes involving sales process, customer relationships, and revenue recognition.
NetSuite: Saved search outputs, transaction records across multiple subsidiaries, and the comprehensive audit trail log capturing who changed what and when across the entire tenant. NetSuite is commonly used by mid-market New York companies in media, technology, and professional services.
Workday: HR, payroll, and financial data with full awareness of effective dating and supervisory organization structures. Workday records appear frequently in New York employment discrimination, wrongful termination, and wage-and-hour litigation.
PeopleSoft (Oracle): HR and financial modules with component-level audit logging, effective-dated rows, and the PeopleTools architecture that separates application data from system configuration. Legacy PeopleSoft deployments remain common at New York government entities and large institutions.
Epic and Cerner (Oracle Health): Electronic health record data, audit access logs, medication administration records, and clinical documentation. Relevant in New York medical malpractice, employment, and HIPAA-related regulatory matters involving hospital systems across the five boroughs, Long Island, and Westchester.
Custom SQL databases: Microsoft SQL Server, PostgreSQL, MySQL, and other relational platforms, including legacy applications built on proprietary schemas with limited or no documentation. NYCF performs direct schema exploration to build the extraction methodology when documentation does not exist.
NYCF's Structured Data Analysis Process
Schema Analysis and System Documentation
NYCF analysts map the relevant database schema: table structures, primary and foreign key relationships, index definitions, views, stored procedures, and triggers. This phase produces a written schema summary documenting what data exists, how it is organized, and what queries will be required to extract it in meaningful form. For systems with poor documentation, which is common in legacy applications at New York-area companies, NYCF conducts direct schema exploration and records all findings before any extraction begins.
Stakeholder Interviews and Scope Definition
Technical interviews with database administrators, application owners, and business users establish which data fields are relevant, how users interact with the system in practice, and which reports or outputs were relied upon in the transactions at issue. This step is critical: the people who use the system daily know things about field semantics, data entry conventions, and application workflows that no documentation captures. NYCF interviews IT staff and business users and documents their input as part of the methodology record.
Query Design and Validation
NYCF drafts targeted extraction queries with date range filters, custodian or user scoping, and record type parameters tied to the matter's scope. Each query is tested against a non-production copy or a limited subset before full execution. The query logic is written up and reviewed with counsel, because the methodology itself can be challenged in SDNY or EDNY depositions and must be explainable in plain terms in a declaration or expert report.
Reproducible Extraction with Chain of Custody
The extraction runs with full logging: timestamp of execution, database version and patch level, complete query text, row counts returned, and hash values of the exported output files. All extraction activity is performed under least-privilege read-only access to avoid any modification of the source data. Chain-of-custody documentation is generated at the time of extraction and carried forward through every subsequent step to delivery.
Normalization into Reviewer-Friendly Output
Raw table exports are normalized into human-readable formats with column headers matching the application's user-facing field labels, not internal column names like "BKPF_GJAHR" or "CUST_ACCT_ID_10." Coded values are decoded using the system's reference tables. Related records from multiple tables are joined into a single output that reviewers can understand without a database administrator on hand. NYCF delivers outputs in Excel, CSV, PDF, review platform load-file format, or any specification required by counsel or by court order.
Expert Documentation and Reporting
NYCF produces a written methodology report documenting the schema analysis, query design decisions, validation steps, and extraction results. This report supports Rule 26(f) meet-and-confer discussions in federal matters and NY Commercial Division preliminary conference ESI submissions, responds to opposing party challenges to production completeness, and provides the foundation for an expert declaration or deposition if the collection methodology is disputed.
Defensibility and Chain of Custody
Courts in the SDNY and EDNY have scrutinized database extraction methodology in discovery disputes. The producing party must explain with specificity what data was collected, how the queries were constructed, what filtering criteria were applied, and whether the output accurately represents what the system contains. NYCF's structured data engagements are designed to answer each of those questions in writing, before a challenge arises and not in response to a motion for sanctions.
Every extraction includes read-only database access with session logging, hash verification of output files at the time of extraction, a signed chain-of-custody log recording each analyst who touched the data, and a query log that can be rerun to produce an identical output. When damages calculations or financial analyses depend on database records, NYCF's approach also documents the mathematical relationship between the raw data and any derived figures so that opposing experts, NY Commercial Division special referees, and court-appointed technical consultants can audit the work independently.
What NYCF Delivers
A schema analysis report with table relationship diagrams and documentation of the application logic relevant to the matter. A written extraction methodology document suitable for disclosure to opposing counsel under Rule 26(a)(2) or in connection with a NY Commercial Division ESI stipulation. Normalized data exports in review-ready format with decoded field labels and joined records. A full query log with timestamps, row counts, database version information, and hash values. Chain-of-custody documentation covering the entire extraction process from access through delivery. An expert declaration or affidavit on the collection methodology, prepared for NYCF analysts to sign, if the methodology is challenged. Availability of NYCF analysts for deposition or trial testimony regarding the database analysis and the extraction process.
Last reviewed and updated: April 2026
ERP and Financial Systems
Oracle E-Business Suite, SAP ECC and S/4HANA, NetSuite multi-subsidiary deployments, and custom accounting databases. NYCF handles the complex table relationships, multi-org configurations, and financial audit trails that standard eDiscovery collection tools cannot address without schema-level expertise.
CRM and HR Platforms
Salesforce via API collection with field history tracking, Workday HR and payroll with effective-dated records, PeopleSoft HCM with component-level audit logs, and custom CRM schemas used by New York financial services and media companies. Each platform requires a different extraction approach tied to its data model.
Healthcare Record Systems
Epic EHR and Cerner (Oracle Health) clinical record extraction with access audit logs, medication administration records, and clinical documentation for NY-area hospital systems. NYCF works within HIPAA-compliant frameworks and coordinates with covered entity legal and privacy teams throughout the engagement.
Custom and Legacy Databases
Microsoft SQL Server, PostgreSQL, MySQL, and Oracle Database direct extractions, including undocumented legacy schemas. NYCF performs direct schema exploration when documentation does not exist and builds the methodology record from the ground up before extraction begins.
Database Discovery Consultation
All consultations are strictly confidential. NYCF's structured data team handles complex database extractions under tight New York litigation timelines. Contact us early to build a defensible methodology before production is due.