Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Use this atlas as an interview menu. Each category is a candidate until its owner confirms the actual system, account, period and available records. Record both business content and separate metadata/logs. Counsel and the receiving specialist set relevance, preservation, lawful authority and proportionate scope.
Messages, work apps, photographs, attachments and account links subject to device/app state.
Ask the owner
Company owned or personal? Which apps and accounts were used, who can authorize collection, and what is available now?
Likely contact
Custodian, MDM owner and legal
Details to confirm
The examiner confirms which app data MDM can reach and what counsel has authorized for personal information, and checks deletion and encryption status to plan any recovery work.
USB/external disks, removable media, notebooks, printouts and offsite files.
Ask the owner
Which media or physical locations were used and who has custody?
Likely contact
Custodian, facilities and records manager
Details to confirm
Records on physical media are traced through physical identifiers, custody records and interviews alongside any network access log, so preserve identifiers and custody from the start.
User owned work files, supported versions, sharing links and retained content.
Ask the owner
Which exact user/site URLs exist, including deleted/unlicensed accounts? What holds, licenses and deletion schedules apply?
Likely contact
SharePoint/OneDrive administrator
Details to confirm
The examiner reviews recycle bin content through its own route, apart from normal eDiscovery search, and confirms current archive and payment conditions for unlicensed accounts with the administrator.
Searchable compliance records, chats/posts, recordings/transcripts and meeting artifacts where supported.
Ask the owner
Which chat/channel/meeting types, policies, organizers and storage locations apply? What known content exclusions exist?
Likely contact
Teams, messaging and site administrators
Details to confirm
eDiscovery uses compliance records rather than the live Teams database. The examiner locates files and recordings in their own storage locations and checks the features and channel behavior in effect for the period.
Messages, attachments and calendar content supported by the actual Workspace/Vault setup.
Ask the owner
Which accounts/domains, delegated/group mail, licenses and retention/holds existed for the relevant period?
Likely contact
Workspace/Vault administrator
Details to confirm
Vault works on the live Workspace data of supported, licensed services under configured policies, so the examiner confirms licenses and policies first and keeps users and their licenses in place until preservation is complete.
Channels, direct messages, files and preserved edits/deletions where the plan and tools support them.
Ask the owner
Which workspaces, plan, export authority, apps, retention and Slack Connect parties apply?
Likely contact
Workspace/org owner and legal
Details to confirm
Export and API access follow the Slack plan and permissions, and the examiner identifies which external organizations control shared content and its retention.
Business use of texts, WhatsApp, Signal, Zoom, chat, voice or other collaboration tools.
Ask the owner
Ask each custodian which actual accounts/apps were used, whether history/recording existed and who controls it.
Likely contact
Custodian, communications owner and counsel
Details to confirm
Candidate category: the examiner checks encryption, device state, disappearing message settings, contracts and legal authority for each app, and plans any export or recovery from those facts.
Account, sign in, role, group, authentication and administrator records if logged.
Ask the owner
Which tenant/account IDs, role assignments, event sources and dates can be exported?
Likely contact
Identity administrator
Details to confirm
Tying a later action to a named person combines the sign in record with session, device and other corroboration. The examiner confirms log availability against actual coverage and retention.
Activity logs, query/export job records, processing errors and source counts.
Ask the owner
What exact licenses, policies, event types, role filters, earliest dates and error reports apply?
Likely contact
Purview administrator
Details to confirm
Content retention and audit log retention are set separately, so the examiner confirms each. A zero result is checked against scope, indexing, permissions and filters before it is read as empty.
Virtual machines, object stores, snapshots, databases, cloud keys and management or data access logs where configured.
Ask the owner
List accounts, subscriptions, regions, services, logging settings, bucket/container IDs, lifecycle rules and providers.
Likely contact
Cloud administrator and application owners
Details to confirm
AWS default Event history holds 90 days of regional management events; data events such as storage downloads are recorded through separately configured trails, which the examiner checks for.
Journaled/ingested mail, attachments, other captured feeds and archive search histories.
Ask the owner
Which feeds/users/date ranges were captured, what failed, and does export preserve original fields and attachments?
Likely contact
Archive owner and provider
Details to confirm
Candidate category. The examiner verifies capture, deduplication and migration history and compares the archive with the source system for completeness.
Point in time data, application/database copies, endpoint backups and old recovery media.
Ask the owner
Which systems/dates, catalogs, keys, overwrite dates, restore methods, cost and licensing are involved?
Likely contact
Backup administrator and provider
Details to confirm
Ask the specialist whether a justified isolated restoration is necessary; restorability is confirmed by a test restore, with job success reports as supporting records.
Customer/contact records, opportunities, activities, attachments, quotes and field histories where supported.
Ask the owner
Which objects, IDs, fields, audit/history features, attachments and integrations cover the dispute?
Likely contact
Sales operations and CRM administrator
Details to confirm
Candidate category. The examiner requests history, deleted records, relationships and linked files specifically, beyond the standard reports, and confirms the vendor and version.
Negotiation files, clause versions, signature envelopes, completion certificates and recipient events where available.
Ask the owner
Which CLM or electronic signature service, envelope/agreement IDs, history/certificates and linked exhibits exist?
Likely contact
Legal operations, contracting and signing service administrator
Details to confirm
A signature certificate is one part of the record; signer identity and the negotiation history are corroborated from account, email, device and negotiation records alongside it.
Employment dates, role/device assignments, access change requests, separation and reimbursement records.
Ask the owner
Which relevant dates, devices, accounts and policy acknowledgments can be supplied lawfully?
Likely contact
HR, payroll, IT and legal
Details to confirm
Keep personnel and unrelated personal data restricted. Offboarding can trigger deletion, token changes or wiping, so coordinate preservation with the legal and security teams ahead of those steps.
Visits, notes, orders, results, medication records, amendments, addenda and signed/unsigned status as stored.
Ask the owner
Which systems, patient/encounter IDs, modules, authors, date types and export formats hold the relevant episodes?
Likely contact
Health information management and clinical application owner
Details to confirm
Candidate clinical locations are confirmed with the vendor and site. Audit data, versions, attachments and departmental systems are requested alongside the printed chart.
Badge/visitor events, CCTV, building controls and vehicle/location records if operated and retained.
Ask the owner
Which camera/door/location IDs, overwrite times, clocks and system owners relate to the matter?
Likely contact
Facilities, security, fleet and legal
Details to confirm
Candidate categories. Confirm privacy/authority and preserve time context; tying a badge event to the person who entered combines it with camera footage, schedules and other corroboration.
D35 Third parties insurers and outside professionals
Possible information
Vendors, brokers, advisers, counterparties, outsourced IT and external archives may hold distinct records.
Ask the owner
Who owns or controls each copy and what request/consent/order or contract right is needed?
Likely contact
Counsel, business owner and provider
Details to confirm
Counsel sets the authority for each third party request, by consent, contract right, subpoena or order, and coordinates lawful requests and restrictions.
