Collecting Evidence From Google Workspace
GOOGLE WORKSPACE EVIDENCE · A GUIDE FOR UK LAWYERS Collecting Evidence from Google Workspace Gmail, Drive, Shared Drives, Chat, Meet and Admin Data: the Other Tenant, Mapped COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: same instincts, different geography 03 The estate map: service by service 04 Preservation: holds, retention and the leaver licence trap 05 Collection routes: Vault, Takeout, API and their fidelity 06 Drive evidence: ownership, Shared Drives and revision histories 07 The admin layer: audit reports and account records 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: THEM365DISCIPLINESTRANSFERWHOLE; ONLYTHEMECHANICS ARE GOOGLE ' S 52 framework: trust, structures, downstream: chooses among them here exactly as there. The distinctly
§ 02 · FIRST PRINCIPLES The problem in plain English: same instincts, different geography
§ 03 · THEMAP The estate map: service by service SERVICE WHAT IT HOLD S · WHAT MATTERS EVIDENTIALLY
§ 04 · STOPPINGTHECLOCKS Preservation: holds, retention and the leaver licence trap
§ 05 · GETTINGITOUT Collection routes: Vault, Takeout, API and their fidelity
§ 06 · THECROWNJEWELS Drive evidence: ownership, Shared Drives and revision histories
§ 07 · THEDIARYHERE The admin layer: audit reports and account records
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (VAULT SYNC / AUDIT EXPORT WORKSPACE DEVICE ADMIN / BACKUP / REACH) CACHES REPORTS LAYER COUNTERPART DELETED / TENANTS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEREVISIONSTREAMTHATDATEDTHEDEALMEMO EXAMPLE2 · THEHISTORY - OFFSPACEANDTHETWOPHONES EXAMPLE3 · THEDELETEDACCOUNTINSIDETHE20DAYS
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · WORKS PAC ELIMBFORTHEWEEK- ON E INSTRUCTION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Workspace checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Is Google Vault the same kind of thing as Microsoft Purview? Can deleted Gmail be recovered? How reliable are Google Docs revision histories as evidence? The space had history off. Is the chat genuinely gone? What happens to a departed employee's My Drive files? We are a Microsoft firm facing a Google-estate opponent. What do we ask first?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Collecting Evidence From Google Workspace, Computer Forensics Lab, https://e-discovery.uk/library/collecting-evidence-from-google-workspace/pdf.