Gmail & Google Workspace Forensics

A convenient remote collection process

We arrange access with the authorized account holder or Workspace administrator. Routine email collection can proceed while users continue working in their accounts. Clients can participate remotely while counsel coordinates scope and deadlines.

1. Identify accounts, custodians, dates and related Drive folders.
2. Confirm authorized access and the relevant collection method.
3. Preserve messages, attachments, agreed documents and available logs.
4. Verify and document the collected evidence for examination or review.

Preserve Gmail and linked Drive documents

A Gmail message can refer to a Google document through a link. The document may have its own owner, sharing permissions, revisions and activity history. We include the relevant file and its context in the agreed evidence plan.

Professional collection preserves original messages and their technical information alongside the associated files. An organized evidence inventory records where the material came from and how it was collected, supporting authentication, discovery and later testimony.

Trace the attack across Google Workspace

A Gmail compromise can extend to Google Drive documents and other shared business information available to the account. The examination should follow the permissions and activity of the compromised identity, rather than stop at the messages in its inbox.

Connect account, mail and application activity

GDF correlates available user sign-in, Gmail, administrator, OAuth application and Drive activity records to develop a coherent evidence timeline. We connect account, application and document identifiers where available, align timestamps, and retain the original exports and collection details.

Application access needs its own examination. A third-party app may have permissions affecting Gmail or Drive, so we review relevant grants, scopes and recorded activity rather than assume a password change addressed every access path. The records and tools available depend on the Workspace edition and administrative privileges. Google OAuth log guidance.

Examine shared files, not just files the user owns

We assess relevant My Drive content, shared drives, group-based access and documents shared with the compromised account. Google Docs, Sheets and Slides can contain business information that never appeared as an email attachment.

Available Drive events can help establish views, downloads, edits and sharing changes. We compare those events with the account and application timeline, while separating routine synchronization and authorized collaboration from suspicious activity. Permission to open a file is potential access, not proof that an attacker opened or copied it. Google notes that not every Drive activity is logged. Google Drive log-event guidance.

Explain what the evidence establishes

Our findings connect the affected accounts, applications and documents, with an inventory of relevant information and clearly stated uncertainties. A suspicious login does not prove every accessible file was taken; absent records do not establish that files were untouched.

Logging coverage, retention, external ownership and collection timing can limit the assessment. Personal Gmail accounts do not provide the same administrator records as managed Workspace environments. We define those limits at the start and document how they affect the conclusions.

Authenticate messages and explain communication

We examine message headers, identifiers, timestamps, attachments and supporting account records to test authenticity. Communication maps can organize messages between accounts and show the dates and documents connecting those exchanges.

The explanation separates the message contents, the technical records and the findings derived from the examination. Counsel receives a clear account that connects the technical evidence to the issue in dispute.

Prepare for review, production and testimony

GDF works with counsel on account selection, date ranges, keywords and ESI specifications. Our internal tools support deduplication, processing, review preparation and load-file creation, reducing repeated work and helping control review volume.

A report can include the collection inventory, relevant messages and files, an activity timeline, authentication findings and exhibits. Our eDiscovery services support production and cost-effective hosting, while expert witness services support reports, deposition and testimony.

Explore Microsoft 365 and Outlook forensics for that platform, or employee exit Core Analysis for a flat-rate departure review within an agreed scope.

Reviewed by Joseph Caruso. September 22, 2026.

Collection and reporting belong together

Robert Knudsen's background includes computer examinations, forensic acquisition, evidence handling and communication with counsel. GDF carries the collection record through to the findings so the source of a message or file can be explained.

Meet our forensic experts and request a CV

Get answers from Gmail and Google Workspace

Find regional collection and engagement information or meet the forensic team. Ask about the collection method and report format that fit your matter.