Microsoft 365, Google Workspace, Slack, Teams and Zoom Collections

Collect the Cloud Without Losing the Metadata

The custodians live in Microsoft 365 or Google Workspace, the candid conversations sit in Teams or Slack, and an administrator's export strips the versions, edits and audit records opposing counsel will ask about. Global Digital Forensics collects each workload through the route the platform supports, keeps the job reports with the data and reconciles what was requested against what came back. Your reviewers receive a package with its context attached and a collection record that answers the first question at the meet and confer.

Get a Free Consultation Call (800) 868-8189

Bagged hard drive beside a forensic write blocker.

Why a Cloud Export Is Not a Cloud Collection

An administrator can export a mailbox or download a shared drive in an afternoon, and that is usually how a discovery problem starts. The export leaves behind the version history, the sharing records, the message edits and the audit events that show who touched what and when, and it rarely records what was requested against what came back. When the other side asks how the collection was performed, the honest answer becomes that nobody is sure.

We approach a tenant the way an examiner approaches a hard drive. Before anything is pulled we confirm the provider, the tenant or account owner, the licensed edition, the administrative roles available, the retention settings in force and the exact data types the matter needs, because mail, chat, linked documents, versions and audit logs each leave the platform by a different path with different limits. We then preserve the original job reports and the returned data and reconcile the requested scope against the returned counts, so the record shows coverage rather than assuming it.

Where keyword or AI assisted selection narrows the collection, we run it under a recorded protocol with validation samples, review of excluded families and decisions approved by counsel. The validation samples and the excluded family review go into the collection record, so the selection can be defended on its numbers.

Review the primary references Microsoft eDiscovery documentation and Google Vault export documentation for the technical background behind the methods we use.

Has an administrator already run an export in your matter? Tell a senior examiner what was pulled and how and we will say what the tenant’s own records can still supply.

Get a Free Consultation

Technical methods and scope

Cloud Collections You Can Explain, Run on Software GDF Owns

Global Digital Forensics has served counsel since 1992, from AmLaw 100 firms and Fortune 1000 companies to small businesses facing their first discovery demand. GDF owns its software and develops the internal tools we collect and process with, which lets us scale a cloud collection to the matter rather than to a platform’s minimum fee and keep the handling of your client’s data under our own control.

Every engagement begins with custodians, accounts, tenants, dates, data types and the approved scope, and ends with a collection record that identifies the source authentication, the administrative role used, the filters, the API or export path, the time of collection, the exceptions and the transfer integrity values. The receiving team, whether that is your reviewers, a review platform or opposing counsel, can read that record and understand exactly what the package represents.

Email, Business Suites and Cloud Storage

We collect supported Gmail, Google Workspace, Microsoft 365 and on premises email sources, and file scope can extend to the configured cloud storage repositories your client actually uses. Before collection we confirm product and connector support, available data types, metadata, retention and administrator access against the provider, the license and the tenant, because each workload leaves the platform by its own route and the license decides which routes are open.

We preserve native mailbox and file items with their available metadata, applying the custodian, date, folder, label or repository filters approved for the matter. The exception record identifies throttling, inaccessible items, deleted content retention windows and export limits, so the handoff carries its true coverage and nobody discovers a gap in a deposition.

Send the custodians and the deadline and the first call sets the collection plan.

Slack, Teams, Zoom and Collaboration Data

Collaboration platforms are where the candid conversations happen, and they are also where exports most often lose the thread. For Slack, Microsoft Teams and Zoom we confirm which messages, threads, edits, reactions, attachments, recordings, transcripts and participant records are available under the platform, the retention policy, the license and the administrator role, then plan a collection that records conversation relationships so a reviewer can follow a message to its replies and its attachments in context.

Search and Prepare the Collection for Review

Once the sources are preserved we search, remove recognized standard system files where appropriate, deduplicate and prepare native, image, text or load file formats for the review workflow the legal team has chosen. Because the processing runs on software we own, unnecessary volume is removed before it reaches hosting or reviewers, which is where most discovery budgets are actually spent. Where AI assists selection, we document the search logic, the sampling, the human decisions and the exclusions. Every filter traces back to an instruction in the review protocol, so the processing record reads as a set of approved decisions.

Describe the sources and the production format, and a senior specialist will map the collection.

Document the Collection and the Handling of the Evidence

Delivery can include collection logs, authenticated source details, integrity values, exceptions, reconciliation, processed volumes and an export manifest. Hash values prove each package arrived unchanged, and the reconciliation and exception records show how completely the provider answered the request. If the collection has to be explained to a court, our examiners have testified in federal and state courts and can describe the method in a declaration, at deposition or at trial. Call (800) 868-8189 to talk through the sources before anything is exported.

If a call is awkward today, send the tenants, the custodians and the deadline in writing and an examiner will come back to you with a collection plan.

Methodology

From Tenant Access to Review Package in Four Steps

Identify custodians and cloud sources

We combine the discovery request, custodian interviews and system knowledge to map the accounts, tenants, retention windows and data types that matter, so the collection follows the case instead of sweeping up the company.
Preserve the authorized records

We put the approved preservation approach in place through authorized administrative access and record owners, dates, scope changes and exceptions, so the later collection rests on a documented basis.
Collect, process and reconcile the results

We use the method appropriate to each source, verify every transfer and reconcile extraction and processing exceptions, so the package can be checked line by line against the request.
Deliver the agreed review package

We validate the delivery against the agreed review or production specification and retain the audit record, so the next team can reconcile it, use it and explain it.

Want to see those four steps in a live matter? Read how two terabytes of raw email and documents became a usable review set for a class action.

Evidence commonly examined

Cloud discovery sources we collect

Custodian and source inventories define the requested population and the systems available to answer it. Microsoft 365 and Google Workspace supply the business suite records, and collaboration and messaging platforms preserve the conversations and their relationships where the platform retained them. Computers, phones and file shares add relevant content that never reached the cloud, databases and structured business systems supply records that need an agreed extraction and interpretation approach, and the collection, processing and exception logs document the work performed and the material that was not returned.

What you can expect

Your collection package and audit record

The data map and scope record identify the requested and examined sources. Collection and processing logs document the methods used and the path from source to delivered material. The exception and reconciliation report accounts for unavailable items, transformations and differences from the request, and the review or production package is validated against the delivery specification before the receiving team opens it.

Ask for this package to be scoped in writing before any export runs: call (800) 868-8189 and we will set out the sources, the formats and the cost.

Plan the Cloud Collection Before the Audit Logs Expire

Audit records in Microsoft 365 and Google Workspace are retained on schedules set by the license, not by the litigation. Tell us the tenants, the custodians, the date ranges and the deadline and we will plan the collection and the package your review team needs, with the first consultation free.

Read the data discovery case study, then ask which of those examiners would run your collection.

Get a Free Consultation

Frequently asked

Scope, Pricing, Platforms and Expiring Audit Logs

What should we define before a cloud collection begins?

Identify the tenants, the accounts, the legal authority for access and the retention settings in force. We then confirm administrative access, the export methods each data type supports and the preservation record, so the collection starts from a documented position rather than a guess.

What determines the price of a cloud collection?

The number of sources, the volume collected, the hosting duration, the review workflow and the production requirements shape the cost. Because GDF owns its software, we can scale processing and hosting to the matter, and we provide an itemized scope with recurring charges and change approvals stated before work begins.

Can you work with our existing review platform?

Yes. Name the platform, the load file formats and the tasks your team is keeping, and we confirm compatibility, transfer methods and responsibilities before collection so the package arrives ready to load.

What if a preservation or production deadline is approaching?

Call (800) 868-8189 with the deadline, the data sources and where things stand. We discuss availability, priorities and a realistic sequence of work before you commit, and we can run a focused preservation step while counsel defines the wider scope.

Can the audit logs expire before the case is filed?

They can. Microsoft 365 and Google Workspace keep audit records on schedules set by the license and the tenant configuration, so we confirm the retention in force on the first call and preserve the sign in, sharing and file events that matter before the window closes.

Talk with an examiner

Preserve Cloud Records Before Your Next Deadline

Tell us which tenants, accounts and channels hold the evidence and when the collection must be done. We check relevant experience, potential conflicts and the scope before engagement, and the first consultation is free.

GDF brings court tested forensic expertise to every collection.

Talk with an examiner

Start the Cloud Collection With a Senior Examiner

On the first call a senior examiner maps the tenants, custodians and data types against the request, flags the audit records closest to expiring and sets out the delivery specification for your review platform. The consultation is free.

Call (800) 868-8189 Get a Free Consultation

Our 24/7 hotline is (800) 868-8189.

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.