Mailbox content
Native messages, headers and embedded attachments preserve communication context. A mailbox export is not a substitute for separately available activity logs.
Digital Forensics
Connect the account records to the event.
We preserve and examine relevant mailbox, attachment, and cloud activity records from authorized accounts. We help you connect communications and account activity to the event you need to understand.
UNDERSTAND THE EVIDENCE
Preserve the message and the record of what happened around it.
A mailbox can show a communication without explaining how the account was used. An audit log can record an action without preserving the document involved. We help you identify and examine the separate content, activity and identity records needed to understand a dispute or investigation.
01 / THE EXAMINATION
Map the sources before choosing an export
We start with the relevant people, accounts, services and dates, then distinguish personal mailboxes, shared mailboxes, archives, cloud drives and collaboration locations. A display name is not a sufficient account identifier. Delegation, aliases, shared ownership and linked files can change where the useful evidence is found.
We also ask where the business actually worked. The relevant document may have been stored in a shared site, edited by several people and circulated through a link. A search limited to one individual’s mailbox can miss that history even if the mailbox itself was collected correctly.
02 / THE EXAMINATION
Treat retention as a fact to verify
Content retention and activity-log retention are different. A hold on a mailbox or site is not a complete preservation plan for mail-flow, audit and sign-in records. The available period depends on the service, configuration, licensing and any earlier archiving. We identify what still exists and document gaps rather than assuming a platform name guarantees coverage.
The priority is to verify coverage, not merely confirm that a preservation request was sent. Record which locations were included, whether the operation completed and whether a separate archive exists. A successful hold or export should not be described as protecting sources it was never designed to cover.
03 / THE EXAMINATION
Read the communication in its original context
Native messages, headers, attachments and related copies can answer different questions from a screenshot or forwarded message. Mail-flow records may help establish handling and delivery, but delivery is not proof that a person read or understood the content. A cloud link may point to a file that changed after the message was sent, so the relevant version needs attention.
We keep the received source separate from any review copy or selected exhibit. If the only available item is a forwarded message or PDF, that limitation is made explicit. The copy can still assist the inquiry, but should not silently take the place of a source that could answer different questions.
04 / THE EXAMINATION
Interpret account activity carefully
We compare relevant log events with the content, identity and access records available. A sign-in, download or sharing event must be read according to the service that produced it. It may reflect a delegated user, application or session rather than the named account holder acting personally. Where the evidence does not resolve attribution, the report should say so.
Business context matters as well as technical context. Normal synchronisation, approved collaboration or a shared-service process can resemble suspicious activity when viewed in isolation. The examination tests the specific concern and records what would be needed to distinguish those explanations, rather than assuming that every external destination is unauthorised.
05 / THE EXAMINATION
Document collection and report the limits
We record the authorised sources, period, filters, export method and significant exceptions. Findings can be delivered as a chronology, selected messages and files, or a scoped technical report. We distinguish what was collected from what was examined and identify uncollected accounts, unavailable versions and missing log periods.
Our collection plan can be staged around urgent retention risks and the questions that will change the next decision. Supported findings can be distinguished from preliminary observations while other sources remain outstanding. The agreed deliverable should make those boundaries clear to a reader who did not supervise the collection.
RELEVANT SOURCES
Follow the evidence across the relevant sources.
The useful sources depend on the question, lawful scope and what remains available. Collection and examination are agreed for the particular matter.
Mail-flow records
Available trace records can help test sending and delivery questions. They are not a copy of the message body and do not establish human reading.
Cloud files and versions
Files, versions and sharing context may establish what was available at a relevant time. A linked document requires its own collection decision.
Audit and sign-in records
These may record account, file or administrative events. Their date coverage, event meaning and retention must be checked for the particular environment.
Other authorised copies
Shared sources, recipient copies, endpoints and backups may corroborate or qualify the account history. Their provenance and coverage must remain visible.
HOW WE WORK
A defined question. A documented examination.
We connect the scope, sources and methods to the result you need, with the limits of the evidence made clear.
Define the account map
Identify sources, stable identifiers, administrators, relevant dates and authority.
Protect content and logs
Plan each source separately and verify preservation or export results.
Correlate the records
Compare communications, file versions and relevant account activity while testing alternatives.
Explain the supported history
Deliver the agreed records and findings with source references, time-zone treatment and known gaps.
BEFORE WE BEGIN
Give us the context. Preserve the source.
A clear first discussion helps us identify a useful scope. Use the contact page for an initial inquiry, not to upload evidence or credentials.
- Provide the question, relevant dates and known accounts or locations.
- Identify the authorised administrator and who can confirm legal scope.
- Describe existing holds, exports, offboarding actions and known retention settings.
- Arrange a secure access and evidence-transfer method; do not send passwords through the website.
COMMON QUESTIONS
Understand the limits
before you begin.
Does a mailbox hold preserve every relevant log?
No. A content hold and activity-log retention serve different purposes. Each relevant trace, audit and identity source needs to be checked and addressed separately.
Can an administrator recover records that have expired?
Not simply by having administrator access or upgrading a licence. Previously archived or separately preserved copies may help, but the existence and coverage of those copies must be verified.
Are screenshots sufficient?
They can be useful leads and should be preserved, but may omit headers, attachments, metadata or surrounding context. Where authorised and available, the underlying message or source export usually supports a more informative examination.
Can a download event prove that a particular person took a file?
It can be relevant evidence, but the event definition, account/session context, available corroboration and alternative explanations matter. A record of account activity is not automatic personal attribution.
Technical references and further reading
General educational guidance. Source-specific capabilities and available records require assessment; legal authority and procedure should be addressed with counsel.
RELATED ARTICLES
Explore related evidence questions.
We share the questions and methods that can help you make a more informed next decision.
Article
Business Email Compromise: Verify the Payment, Not Just the Email
A familiar email thread does not authorize a payment. We explain how trusted callbacks, independent approval and a clear fraud response can help your team verify a request before money moves.
Help your team recognize and respond to suspicious changes in payment instructions.
Read article
Article
Suspected Employee Data Theft and Evidence Preservation
When you suspect employee data theft, you need to protect the business without losing the evidence. We explain how to coordinate offboarding, lawful collection, cloud logs and device evidence while keeping allegations separate from verified facts.
Preserve the devices and accounts that matter when investigating suspected employee data theft.
Read articleYOUR NEXT STEP
What do you need to understand?
Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.