Redirected wires. Hijacked mailboxes. Microsoft 365 and Google Workspace evidence.
Business Email Compromise Analysis That Traces the Attacker Before the Logs Expire
A wire went to an account your vendor never owned, or a customer just asked why your company sent a strange invoice. Global Digital Forensics analyzes compromised Microsoft 365 and Google Workspace accounts, reconstructs what the attacker read, changed and sent, and gives your bank, your insurer and your counsel the evidence each of them will ask for. We have answered these calls since 1992, with 24/7 response across the country and examiners who have been accepted by federal and state courts.
The first hours
What We Do in the First Hours After a Business Email Compromise
Tell us what you know so far: a payment that reached the wrong bank, an invoice your company never sent, a forwarding rule nobody created. Global Digital Forensics has operated since 1992, and our email practice has completed hundreds of compromised account analyses. In the first hours we lock down the account records that expire, map what the attacker could reach and give your response team and counsel a working picture of the incident while the trail is still warm.
Preserve the records before they expire
Sign in logs, audit records, mailbox rules and message traces are preserved from the Microsoft 365 or Google Workspace tenant at once, because the provider’s retention clock started the moment the attacker logged in.
Trace the attacker through the account
We connect the phishing message, the unfamiliar sign in, the hidden inbox rule, the invoice thread and the altered payment instructions into one timeline your team can act on.
Arm the bank, the insurer and counsel
You receive the technical findings, the timeline and the information inventory that a recall request, a cyber insurance claim and a notification assessment each depend on.
Contain the Account and Preserve the Evidence in the Same Motion
The first call settles who is doing what. We confirm your incident contact, the examiner assigned to you, who holds the administrative authority to contain the account and how fast each step can happen. Containment and preservation then run together, because an attacker who still holds a session can delete the very records that prove what they did, and a response team that resets passwords without recording what it changed can erase the line between the intruder’s actions and its own.
We then define the affected accounts, the activity window and the population of messages and files in play, including anything deliberately left outside the scope. From there the work separates what the attacker could reach from what the records show they actually touched. A message sitting in a mailbox does not by itself prove it was read or taken, and we keep that distinction visible in every finding counsel receives.
GDF analyzes compromised Microsoft 365 and Google Workspace accounts for businesses and the counsel who represent them. Our email practice has collected thousands of mailboxes and completed hundreds of compromised account analyses, and our business email takeover forensics service describes the full examination and report when the matter calls for it. Microsoft’s own reference for audit activity definitions (opens in a new tab) lists the records we preserve first.
If Money Moved, Call the Bank Before You Call Anyone Else
If funds were transferred, contact your bank immediately and ask its fraud team to request a recall from the receiving institution. Report the incident to the FBI's Internet Crime Complaint Center at IC3. Do not wait for a forensic report before doing either, because the examination runs in parallel and supports what the bank, the insurer and counsel will ask for next. Recovery is not guaranteed, and the first hours decide most of it. FBI guidance explains the reporting path.
Our founder leads the practice. Explore the technical background of Joseph Caruso, accepted as an expert in computer forensics and computer science in federal court.
Prove What Was Sent From Your Microsoft 365 Account and by Whom
You usually hear about it from outside. A customer asks why your company sent an odd message, a vendor says the payment details on your invoice changed, or your own team finds sent items nobody wrote, missing mail and a forwarding rule nobody recognizes. Each of those is a symptom, and the first job is to establish which problem you actually have.
We compare the original messages with the account’s own records to decide whether someone was inside your Microsoft 365 or Google Workspace account or merely impersonating it from a forged sender address or a lookalike domain. The two call for different responses, and getting the diagnosis wrong wastes hours you do not have.
When the evidence shows a genuine intrusion, we identify every message the intruder sent, forwarded, deleted or changed and tie each one to the sign in, session and rule activity behind it. The result is a supported sequence of events, with the accounts involved named and the gaps in the record stated, so your team understands the incident rather than guessing at it.
Trace the Altered Invoice Back to the Attacker
A fraudulent payment request convinces people because it arrives inside a real conversation, from a real address, at the moment an invoice is due. Preserve the original messages, every version of the invoice, the payment instructions and the transaction records now, and keep the native email files rather than screenshots or pasted text, because the headers and identifiers that prove where a message came from do not survive a screenshot.
Before any further payment goes out, verify the instructions by calling a contact you already know at a number you already trust, never the number in the suspicious message. FBI guidance on business email compromise says the same.
GDF then lays the email and account evidence against the payment timeline to show how the instructions changed hands, which events the records support and where the record runs out. An unfamiliar IP address alone does not identify a person, so we look for independent corroboration before we tell you who did what.
Find the Access That Survives a Password Reset
A new password closes one door. An attacker who has lived in a mailbox for weeks leaves others open: active sessions and tokens, added authentication methods, consented applications, forwarding and inbox rules, delegated access and administrator changes. We work alongside your IT department or managed service provider, pairing their knowledge of your environment with our Microsoft 365 and Google Workspace compromise analysis, and we say plainly when the people handling response need help securing a platform they have not had to defend before.
We examine the available evidence of each persistence route to establish how access began and what still has to be revoked. Restoring email service tells you the mailbox works again. It does not tell you the intruder is gone, and your insurer and counsel will want evidence of the second point rather than an assumption.
Containment and preservation proceed together. Do not leave an account exposed while waiting to collect perfect records, and keep a running log of every response action and the time it happened so the examination can separate your team’s work from the attacker’s. Microsoft’s account compromise response guidance and Google Workspace account security guidance describe the platform steps.
Identify How the Attacker Got In
Business email compromise starts somewhere specific: a phishing page that captured a password and a session, a targeted message to the controller, a fake IT support call, credentials exposed in an earlier breach, an authentication prompt approved by a tired employee or an application permission nobody questioned. We examine each candidate route against the messages, sign in records, security settings and relevant device evidence until the record supports one account of how the compromise began and continued.
The report separates what the evidence establishes from what remains unresolved, and it turns the entry route into specific fixes: stronger authentication, tighter application permissions, better account recovery and help desk verification, and independent confirmation of any change to payment details. Closing the door the attacker actually used is the most practical protection against the next attempt.
The FBI describes the phishing and help desk impersonation techniques behind many of these incidents.
Assess Exposure of Personal and Patient Information for Counsel
A compromised mailbox rarely holds only invoices. It holds personnel files, patient correspondence, attachments and links into other business systems. Whether that content was present and whether the attacker reached it are two separate questions, and notification counsel needs both answered with evidence rather than assumption.
Within the agreed scope we examine the evidence of mailbox access, forwarding, downloads and other activity, then review the relevant messages and attachments for personally identifiable information, or PII, and protected health information, or PHI. We document the information and the people potentially affected, and we state exactly how logging, retention and other gaps limit what the record can show.
Counsel receives the timeline, the findings and a scoped information inventory with the uncertainties spelled out, and counsel decides what notification the law requires, to whom and by when. Missing evidence is not proof that information was untouched, and we never let an absence of logs be read as an absence of access.
For organizations subject to HIPAA, GDF supplies the technical evidence for counsel’s assessment under the applicable breach notification requirements described in HHS breach notification guidance.
Turn the Incident Into Training the Next Attacker Has to Beat
The people who approve payments, reset passwords and answer the help desk line are the targets, so education has to reach executives and finance staff as well as everyone else. The most effective material comes from your own incident: the actual message, the actual call, the actual authentication prompt, shown to the people who will see the next version of it.
Give employees a fast, blameless way to report a concern even after they have clicked the link or approved the request, because the hours between the click and the report are the hours the attacker uses. Reinforce independent verification of every sensitive request through a contact method you already trust, and fold the lessons from the examination into procedures, security policies and technical controls. NIST guidance on phishing awareness offers a practical starting point.
What Your Business Email Compromise Examination Delivers
Business email compromise, or BEC, is the family of frauds that misuse trusted business communications. Some run from inside a mailbox the attacker controls; others rely on impersonation from outside. The examination brings the relevant messages, the account activity and the business events into one supported account of what happened, built from the evidence your tenant actually retained.
The original emails, headers and attachments establish what was communicated and preserve details that screenshots and pasted text lose. Microsoft 365 or Google Workspace sign in and audit records reconstruct who accessed the account, from where and when. Mailbox activity, forwarding rules, application permissions and security changes expose unauthorized actions and the persistence left behind. Initial access and persistence analysis names the controls your response team has to address, and a correlated timeline ties the account activity to the email, invoice and payment events that cost your business money.
Where the mailbox held sensitive content, review of the relevant messages and attachments identifies personal and patient information within the defined population, and an affected information inventory gives counsel the evidence for the reporting assessment. The written report explains each finding, the records behind it, the corrections we recommend and the limits of the available evidence. We plan the work around authorized accounts, available logging, retained records and the questions your team needs answered. Missing records can limit the conclusions. For the detailed collection and reporting process, see Email and Microsoft 365 Forensics.
Talk With a Senior Examiner Today
Tell us whether suspicious email was sent, payment details changed or money was transferred, and how to reach you. The first consultation is free, and a senior examiner will map the preservation steps, the account analysis and the deliverables your bank, insurer and counsel will need. Keep passwords, access tokens, bank details and evidence out of the initial contact form; we arrange secure sharing separately.
Every hour the logs age. Discuss an email compromise with Global Digital Forensics now.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .