The data room contains what the target wants the acquirer to see. The forensic record contains what the target's day-to-day operations actually produced. The gap between the two is where most post-close litigation surprises live.
Pre-close forensic diligence typically addresses:
Unfinished litigation and pre-litigation matters. Email and chat search across the target's leadership for terms suggesting active disputes, regulatory inquiries, or contemplated actions. These often surface matters that haven't been disclosed in the rep-and-warranty schedules.
Trade-secret exposure. Were prior employees who left for competitors targeted with preservation orders? Are there forensic artifacts suggesting outbound IP movement? These risks transfer to the acquirer at close.
Departing-executive risk. Are any of the target's senior personnel showing pre-close behavioral patterns consistent with planning to exit post-close with material? The forensic record of pre-announcement activity is often dispositive.
Compliance posture. Were the target's eDiscovery, legal hold, and preservation practices defensible? Acquirers inherit not just the target's matters but the target's evidentiary discipline (or lack thereof).
Information-security debt. Active malware footholds, unremediated breaches, unpatched systems — the forensic record reveals what the IT-side data room may not.
For deal counsel: forensic diligence is a discrete workstream that runs alongside, not after, financial and legal diligence. The findings often shape final purchase price and rep-and-warranty negotiation.