// evidence type
HRIS / SaaS audit export
Workday · ADP · UKG · Carta · Topia CSV/JSON audit log you exported from admin console. parse user/action/timestamp rows — no live API, no upload.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this evidence type.
- workday hcm audit log forensic analyzerdrop workday hcm export · parse worker + job + user · runs locally
- adp payroll audit log forensic analyzerdrop adp export · parse paycheck + employee + approver · runs locally
- carta equity cap table export forensic analyzerdrop carta export · parse grant + vest + user · runs locally
- topia global mobility export forensic analyzerdrop topia export · parse assignment + policy + user · runs locally
- navex ethics hotline export forensic analyzerdrop navex export · parse report + category + user · runs locally
- servicenow hrsd case export forensic analyzerdrop servicenow hrsd export · parse case + task + user · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
also useful · secondary tools
supporting and follow-up tools. surface as the investigation widens.
- ukg payroll audit log forensic analyzerdrop ukg payroll export · parse pay + benefit + user · runs locally
- shareworks equity admin audit log forensic analyzerdrop shareworks export · parse award + exercise + user · runs locally
- cartus relocation export forensic analyzerdrop cartus export · parse relocation + benefit + user · runs locally
- hr acuity investigation export forensic analyzerdrop hr acuity export · parse case + allegation + user · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
- incident timeline builderdrop multiple CSVs with timestamps from any forensic tool · merge into unified chronological timeline · entity tagging · filter by source · export full timeline · runs locally