A friend of mine who is involved in litigation has asked me for advise on how he can harvest the data out of his J.D. Edwards configured accounting system. My understanding of this system is that it is organized through a series of Databases as many ERP systems are and can be configured to work on several different database technologies.
Has anyone here ad any experience harvesting from a J.D. Edwards accounting system and if so do you have any advise?
Thank you,
Just like any other 3-tier ERP, the data is stored on a Oracle database (there used to be other databases) with schemas and tables. Any DBA who knows the database schema and tables will know where specific records are stored. The data attributes of one record may be stored in more than one table, and if you want the complete record, they need to be extracted, from the tables, and joined in an output file. In this case, the term data extraction is more appropriate than harvesting.
CFEx is correct, however, as a former Oracle Applications/JDE instructor, I would caution you that the only practical way to harvest data from these systems is via the application, itself.
Both Oracle Applications (financials), and JDE have a public and a private interface. The public interface consists of tables and views which can be accessed, directly, by the end user. These are commonly used to create custom reports or import or export data from/to other applications.
Private tables are used by the application to store and manipulate the data and are subject to change. typically the use and function of these are undocumented and that makes using evidence extracted from them, directly, problematic.
Unless your expert is very familiar with how the data are organized, drawing conclusions from the raw data can be tricky and, I might add, useless unless you suspect that the subject possessed a high degree of technical sophistication, impractical.
In my experience with these situations, the common approach is to copy or virtualize the application and then use a forensic accountant familiar with the operation of the application to examine the records using the application, itself.
… as a former Oracle Applications/JDE instructor
Are you doing forensics as a career?
Thanks guys.
Based on your advise and the fact that we have the DBA's full cooperation, I'm going to advise that the JD server be imaged and a virtual environment be used to manuever the tables using the application.
Do you guys know if the JD installation is tied to the system's Processor or MAC Address? Since VM environments use the local CPU and NIC, the applicaiton might not load up.
Thanks
It's been 2 1/2 years since I worked with JDE, but I doubt it is tied to the system processor or MAC address. The DBA may have a more accurate answer.
That said what really comes to mind is that you will need a very good workstation to run the image in a virtual environment (lots of RAM, CPU, etc.).
I work with Oracle databases. As I see it, you would need two types of data collections. First you need to have the dba perform cold backup. This basically mean the databases needs to be shutdown and all database files need to be copied to your choice of destination. Second the application server needs to be shutdown and copied over.
Before stopping the database, I would find out if they copy or move their audit records to another database. If they do, I would get a copy of that database. That will give a complete picture of what has been going on in the database.
… as a former Oracle Applications/JDE instructor
Are you doing forensics as a career?
Now I am. Before that I had to make a living in the real world.
Do you guys know if the JD installation is tied to the system's Processor or MAC Address? Since VM environments use the local CPU and NIC, the applicaiton might not load up.
No. Oracle/JDE are not as paranoid as that. However, if the DBA knows his/her job, the database may be tuned to the hardware configuration and substantially changing the configuration of the VM could cause issues with application performance.
Also, if you are running on top of a Windows instance that needs to be activated, you could have a problem there, as well.
And don't forget about licensing issues if you run a separate instance of Oracle on another machine/VM.
In addition, there is a connection between the tablespaces and the physical disk as well as the rollback segments, and other components.
If you don't replicate those, you may not be able to mount your database in your VM.
There is more to this than I am able to go into, here, but I'm not sure that I would do this the way that you propose (and I mean that I'm not sure, not that I wouldn't). Depending upon what it is that you suspect, there are other ways to replicate your working environment which would be sound from the perspective of forensic accounting, even if they would not be considered forensically sound from the perspective of the raw device.
I am tending to agree with Indy50 that a better idea would be an actual database backup, loaded into another Oracle instance. How to do this is well documented and well understood by DBAs and much less fraught with problems.