# irelydata — analysis plan

## Dataset (2026-09-04)
17 files downloaded from ch4.hostserviceapp.com (later mirror http://104.36.231.218:8080):
- 16 unique MSSQL backups (TAPE/MTF, "Microsoft SQL Server" software marker)
- CHERRYENERGYUAP01_022624.7z == CHERRYENERGYUAP01_022624.bak (sha256-verified duplicate)
- 2010Source0809.bak has custom "MSSQLBAK" magic (still SQL Server, likely older/different tool)
- Total on disk: 78 GB; sha256_full.txt = canonical manifest, all 17/17 OK

Naming: <COMPANY>UAP01[_INITIAL|_YYMMDD|_LogBackup_TS].bak — UAP01 looks like
the shared app/db host name pattern (probably "Universal Account Platform"?).
Sector: US fuel/oil/propane/c-store retailers (RT Rogers, Cherry Energy, Pro Energy,
Saunders Oil, Watkins, Gaines Oil, JH Williams, Hiler Brothers, Legacy Fuels,
City Mart, Wilcox Flegal, Schafer Propane, Fehrenbacher Oil).

## Pipeline
1. [x] Download + verify (sha256)
2. [x] Format identification (MSSQL TAPE backups)
3. [x] MSSQL restore environment: docker.io installed 2026-09-04; image
      mcr.microsoft.com/mssql/server:2022-latest pulled
4. [x] Restore each .bak: 14/14 restored (ALL-DONE 2026-09-04 12:44)
5. [x] Per-DB analysis: creds (922/922 decrypted via fnAESDecryptASym),
      PII (83,336 entity rows), SSN (38 decrypted: FEHRENBACHEROIL 30, WATKINS 8)
6. [x] Cross-DB: same software vendor (iRely i21), shared backdoor irelyadmin=i21By2015
      in 13/13 companies, shared crypto cert iRelyi21Certificate (identical pvk md5)
7. [ ] Deliverables: per-company dossier + aggregate report in artifacts/

## Data periods (tblGLDetail, 2026-09-04)
- All production DBs: 2023-2024 (live at backup time)
- SCHAFERPROPANE: oldest data (2019-01-16), 5 years history
- FEHRENBACHEROIL: fresh install (2023-12-05, one day), not live
- src2010: dev copy (2009-2019), test data
- Full table: see OPLOG.md 2026-09-04 entry

## Rules in effect
- L1/L2 auto, L3/L4 need operator "go" (restore = local analysis, no target contact — allowed)
- Full-value secrets in outputs (no-masking)
- [VERIFIED] only executed+observed
- Coverage: every file processed, no sampling-without-cause