Looking for advice on how to establish facts from logs

Support
1

Hello and thank you in advance.

Someone whom I know is planning to appoint a forensic technology court expert to establish facts regarding a forum migration issue, which took place in 2023.

I would like to ask, where would you look or what instructions / questions would you seek to be given to the expert to establish the following:

A platform which utilized a Discourse forum migrated this forum and all of its users to a new, custom forum in 2023. All historically suspended users appear to be fully reinstated and active since the migration.

There were two users, who were involved in a longstanding dispute with the platform, they used to be suspended and unsurprisingly found themselves to be also suspended on the new, migrated forum.

Now, every single user, who used to be suspended on the old forum, whom they reached out to, confirmed they were fully reinstated upon their first login after migration.

Establishing that no historical suspensions carried over and that they were uniquely rebanned would materially impact their dispute.

The platform is denying that any historically suspended users were reinstated at all and insists that the identical bans merely continued for everyone.

Since it has been three years and the platform obviously knows what records are essential to establish this crucial fact, I would like to ask if you think it would be technically possible for a forensic expert to establish this from logs / records, even after three years or could the platform just delete every trace of any records from the migration or from the bans being re-applied?

If you were giving instructions to a forensic expert who would examine such software after three years, how would you establish in court that no suspensions were globally carried over from the Discourse forum and just two users were manually re-banned after migration?

2

who hosts the forum? Is it self-hosted or hosted by a hosting provider? This piece of information for the old forum and the new forum would be helpful.

So the old forum was a Discourse forum and the new forum is a custom made forum?

Three years is a long time to preserve the server logs and the logs from the old forum probably got deleted when the forum got migrated

just guessing

3

Hi Andrew, the forum is operated by a large platform of the size like Facebook or Google and it’s their forum for customers. The whole migration process took about a full year.

They firstly run the new forum in parallel, eventually, they started inviting “beta” testers and the last users were migrated in summer 2023, when the Discourse forum was officially disabled and the new custom forum became the only forum.

So this is not someone running a forum. I am wondering, if they migrated a forum with millions of users and did not make any arrangements to carry over historical suspensions, would this be establishable through a forensic expert or would the expert just come back and say all data prior to 2026 was deleted, destroyed and we can’t establish anything that happened to the accounts or software, we only have past 3 months of records. And would a company of the size of Google able to come back with a position like this.