Analyzing IT system logs and failures for a dispute

Materials required

• contract, technical specifications, detailed technical specifications, annexes and acceptance certificates;
• correspondence between the parties and comments on acceptance;
• logs, exports, screenshots, links and technical documentation;
• questions formulated for the specialist or court.

What is assessed

The examination assesses the actual condition of the deliverable, compliance with technical requirements, defects, causes of failures, the volume of completed work and the relationship between the findings and the documents in the dispute.

Why original logs must be preserved

Logs contain timestamps, operation identifiers, error messages and information about component interactions. Exporting only selected lines may deprive an event of its context, so the full period before, during and after a failure should be preserved wherever possible.

What can be established

• the sequence of system requests and responses;
• when an error occurred and which components were affected;
• retries, timeouts and integration failures;
• actions by users and administrators;
• whether actual events match the technical documentation.

Examination limitations

If logs have been overwritten, time settings have changed, parts of the infrastructure are unavailable or software versions have not been preserved, a definitive conclusion may be impossible. These limitations must be expressly stated in the specialist opinion.

How to formulate questions

It is best to ask technically verifiable questions: which events preceded the failure, which components failed, whether the logs record actions by a particular account and whether the system meets the specified requirements.

How work with a specialist proceeds

First, the task and available materials undergo a preliminary review. The examination subject, technically appropriate questions, required access and deliverable format are then agreed. If the initial data are insufficient, the specialist identifies in advance which additional files, documents or exports must be preserved.

The final opinion distinguishes the information provided, actions performed, indicators established, limitations and conclusions. This structure makes the reasoning verifiable and enables the document to be used in a formal claim, negotiations or court proceedings.

When to seek advice in advance

The earlier original data are preserved, the lower the risk of loss or alteration. Before reinstalling a system, updating software, clearing logs or handing a device over for repair, it is advisable to discuss how the materials should be recorded.