Forensic data extraction from accounting systems

A full transaction-level export from the accounting system in use, pulled at the widest available detail level rather than a summary report. Where the platform retains a log of deleted, voided or edited entries, that log comes out alongside the transaction data, tagged to the user who made each change and when. The export is matched to a control total from the live system before it is handed off for tracing, fraud-indicator testing or reconstruction, and everything is delivered as a working file organized by account and period so the next phase of the engagement can start immediately.

We start with view-level access to the accounting system, confirm the reporting period and accounts in scope with whoever engaged us, then run the export in the format that keeps the most detail, typically a full transaction listing plus the platform's own audit or activity log. QuickBooks Online, Xero and NetSuite each expose this differently, so the export method is chosen per platform rather than run the same way everywhere. Once pulled, the data is reconciled to a control total, organized into a working file, and a short extraction memo is written noting the date range covered, anything the platform could not retrieve, and the control totals used to confirm completeness.

Counsel or a business owner who has already scoped a forensic matter, whether that is a suspected diversion, a partner dispute or an insurance claim, and now needs the underlying data pulled cleanly before the substantive work begins. It also fits a board or audit committee opening an internal investigation who need a preserved, dated export before anyone else touches the file, and any situation where a system is about to be migrated, closed, or handed to a new bookkeeper and the transaction history needs to be captured first.

A prior export that was a summary report rather than transaction detail, which looks complete until someone tries to trace an individual payment and finds it was never broken out. An export pulled with edit access still open on the live file, leaving the door open to a later question about whether the record was touched during the review. A missing reconciliation step, so nobody can say with confidence the export matches what the system actually held on the extraction date. And gaps caused by a sub-ledger, a payroll processor feed or a payment gateway that syncs into the main system but was never pulled separately, leaving a hole in the transaction history that only shows up once tracing hits a dead end.

Extraction runs against whichever system the business already uses: QuickBooks Online, Xero, NetSuite or, less often now, Sage Intacct. Each platform's own audit or activity log is pulled alongside the transaction data rather than relied on as a substitute for it. Where bank or card data sits outside the accounting system, in a bank's own portal or a payment processor's dashboard, that gets pulled as a separate, dated export and reconciled the same way. Microsoft Excel is where the combined working file gets organized once everything is out of the source systems.

Extraction is quoted as part of the overall forensic engagement rather than as a standalone fixed fee, since the time it takes depends on how many systems and accounts are in scope, how far back the period runs, and how much of the audit trail the platform still retains at that age. A single-entity QuickBooks Online extraction covering one fiscal year is a small piece of a larger engagement; a multi-entity pull spanning several systems and several years is scoped and quoted on its own before work starts. See the rate card for how our standard monthly bookkeeping tiers are priced; forensic and investigative work is quoted separately after a scoping call.

The test is simple: does the extracted total tie to the control total from the live system, and can every figure in the export be traced back to the system it came from. A senior reviewer reviews the reconciliation before the export moves to the next phase of the engagement, and reviews the extraction memo for completeness. If a platform cannot retrieve a piece of history, deleted user-activity records older than the platform's retention window, for example, we say so in writing rather than let a gap pass unnoted.

A workpaper only holds up in front of counsel, a mediator or an insurer if the chain from source system to finished exhibit is unbroken, and that chain starts at extraction. We date every export, note who pulled it and from what access level, and keep the original export file untouched once it is in hand so any later question about what the data looked like on a given date can be answered from the file itself rather than from memory. This matters most in matters that may eventually involve a testifying expert, where the underlying extraction is exactly the kind of detail opposing counsel will ask about first.