Microsoft 365 Forensics From Mailbox Rules to Audit Logs

Remote Collection That Keeps Your Business Running

Most Microsoft 365 collections never require us to touch a laptop. We begin by defining the accounts, date ranges, linked files and discovery requirements with counsel so the collection follows the questions in the case rather than sweeping up everything. We then coordinate authorized access with the account owner or administrator and agree a preservation and security plan, which is the step that lets your people keep working in Outlook while we work behind them.

With access in place we preserve original messages, attachments and the agreed files and logs with documented handling and integrity checks, then reconcile the source inventory against what came back before analysis begins, so gaps surface on day one rather than in a deposition. In an active compromise the order changes: we help you contain first and preserve alongside, because an attacker who still has access can destroy the logs that would prove what they did.

From the Phishing Login to the Redirected Wire

A compromised mailbox is rarely just a mailbox. Depending on the permissions the identity held and the access the attacker obtained, the same login may have reached OneDrive files, SharePoint libraries, Teams conversations and shared business records, and the fraud that follows is usually staged from inside the real account. Microsoft's guide to responding to a compromised email account describes that wider risk; we reconstruct it from your tenant's records.

Connect every record into a single evidence timeline

We correlate Entra sign in and audit records, Exchange mailbox activity, Purview events, SharePoint and OneDrive file activity and relevant Teams records into one chronology. Account, application, session and file identifiers tie the events together, and we preserve the original exports and time conventions so the timeline can be checked by anyone who needs to check it. Microsoft’s audit event reference defines the events, and our job is to show what they mean in your incident.

That timeline is what separates the attacker from your legitimate users, response actions and routine synchronization. It shows which identities and applications touched which resources, what was read, downloaded or shared before and after the suspicious activity, and which records support each attribution, so your report says what the evidence proves rather than what it suggests.

Follow the attacker’s access to shared data

One compromised identity may have been able to reach documents owned by other people, shared libraries and files linked through Teams. We assess group memberships, sharing links, delegated access and application permissions alongside the activity records, because the question your board, your insurer and your regulator will ask is not only what the account could reach but what the evidence shows was actually taken.

When suspicious sign in activity is followed by downloads from a shared library, the examination moves beyond the mailbox. Permission to reach that library is one fact, evidence that its contents left is another, and we keep the two distinct in the report.

Affected accounts and exposed data, explained

The result is a connected account of the affected identities, systems and data, supported by the evidence timeline and an information inventory. Confirmed activity is kept apart from potential exposure that needs further analysis, the exact distinction notification counsel needs.

Coverage turns on licensing, audit configuration, retention and collection timing, and an IP address alone does not identify a person, which is why we preserve the available records the moment containment begins. Microsoft's overview of auditing solutions in Microsoft Purview sets out the retention periods that drive the clock.

If the compromise is still unfolding, call (800) 868-8189 before the tenant is rebuilt, so the activity records are preserved before anything changes them.

Control eDiscovery Cost and Deliver a Usable Production

We help the legal team define custodians, dates, searches and production fields before collection begins, because scope decided early is the cheapest scope. Our internal tools handle collection, duplicate handling, standard system file filtering, review preparation and load files, which reduces repeated handling and keeps unnecessary material out of review.

The load file links every document and its metadata for the agreed review platform, and original files, attachments, text and selected fields stay connected to their collection records all the way into the production. Explore our eDiscovery collection and hosting options when the volume calls for it.

Genuine Messages and Who Was Talking to Whom

We compare original messages, headers, timestamps, message identifiers, attachments and the related sender and recipient records to test whether a disputed email is consistent with how it was sent and received. Message tracking then reconstructs how it moved through routing and delivery, and relationship maps organize the recorded exchanges between people and accounts by date, message and attachment.

A communication map can tie a project email to its recipients and to every later message that carried the same attachment, presented beside the original records. That is the exhibit that settles the argument over who knew what, and when.

Authenticity and Authorship Are Separate Findings

A message can be authentic while the person who sent it is in doubt, so authenticity and authorship get separate findings. Native structure, trusted routing, identifiers, attachments and independent copies support the authenticity analysis, and SPF and DKIM results add context about the sending infrastructure. Whether a particular person took a particular action is decided on its own evidence.

Keeping them apart matters because they combine in more than one way. A message can be genuine while the account that sent it was hijacked. A message can be authentic as sent and altered after export. We establish which proposition the evidence reaches and build the picture from there.

Reading a Microsoft 365 Audit Event Correctly

Microsoft’s MailItemsAccessed records distinguish synchronization of message sets from access to individual items, and we interpret each event with its account and session context rather than treating it as proof that a person read the screen. Synchronized copies may remain readable offline, which matters to exposure analysis even when no later server read event exists.

We document license, tenant settings, retention and event age at collection because each one changes what the audit record can show. Mailbox holds and activity logs follow separate preservation paths and retention periods, so our collection plan secures both before either expires.

Attachments and Linked Files Are Different Evidence

A message can carry a fixed copy of a document or a link to a cloud file that kept changing after the email was sent. A sound collection plan captures the linked file, its relevant versions and the sharing and activity history around it, instead of assuming the mailbox holds the whole story.

Picture a payment discussion that links to a spreadsheet whose bank details change two days later. The message and the version history answer different parts of that sequence, and we examine both within the agreed scope and present the supporting records together.

What Your Email Forensic Report Will Show

Every report opens with the question, the accounts and the period examined, then explains how the sources were preserved and what was obtained. The authenticity findings or the communication timeline address the message evidence, the account activity findings tie each recorded action to its record, and the exhibits present the findings at the level the audience needs, whether that is a judge, a claims adjuster or a board. Production sets are prepared to the agreed specification.

For Gmail and Google Drive, see Google Workspace email forensics. When an employee leaves with company files, employee exit Core Analysis covers the devices and accounts at a flat rate for an agreed scope.

Full examiner credentials are in the examiner profiles on the About page.

Ask an examiner how this applies to your matter; the first consultation is free.

Examiners Who Explain Email Evidence to Judges and Juries

Robert Knudsen holds the CISSP and Certified Computer Examiner credentials and brings eighteen years of forensic casework, hundreds of computer and mobile device examinations in federal and state court matters and twenty years with the New York City Police Department. Joseph Caruso, our founder, has examined email, source code, mainframe databases and business systems in technology disputes across a career that began in 1980, and his analysis of disputed email metadata in COMLAB v. Kal Tire is the work a federal court called highly credible. The examiner who collects your evidence is the examiner who explains it.

Read the examiner profiles and request a CV