Collecting Evidence From Google Workspace

GOOGLEWORKSPACEEVIDENCE · AGUIDEFORUKLAWYERS Collecting Evidence from Google Workspace Gmail, Drive, Shared Drives, Chat, Meet and Admin Data: the Other Tenant, Mapped COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: same instincts, different geography 03 The estate map: service by service 04 Preservation: holds, retention and the leaver licence trap 05 Collection routes: Vault, Takeout, API and their fidelity 06 Drive evidence: ownership, Shared Drives and revision histories 07 The admin layer: audit reports and account records 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : THEM365DISCIPLINESTRANSFERWHOLE ; ONLYTHEMECHANICS AREGOOGLE ' S 52 framework: trust, structures, downstream: chooses among them here exactly as there. The distinctly § 0 2 · FIRSTPRINCIPLES The problem in plain English: same instincts, different geography § 0 3 · THEMAP The estate map: service by service SERVICE WHAT IT HOLDS · WHAT MATTERS EVIDENTIALLY § 0 4 · STOPPINGTHECLOCKS Preservation: holds, retention and the leaver licence trap § 0 5 · GETTINGITOUT Collection routes: Vault, Takeout, API and their fidelity § 0 6 · THECROWNJEWELS Drive evidence: ownership, Shared Drives and revision histories § 0 7 · THEDIARYHERE The admin layer: audit reports and account records § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (VAULT SYNC / AUDIT EXPORT WORKSPACE DEVICE ADMIN / BACKUP / REACH) CACHES REPORTS LAYER COUNTERPART DELETED / TENANTS RECOVERABLE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEREVISIONSTREAMTHATDATEDTHEDEALMEMO EXAMPLE2 · THEHISTORY - OFFSPACEANDTHETWOPHONES EXAMPLE3 · THEDELETEDACCOUNTINSIDETHE20DAYS § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · WORKS PAC ELIMBFORTHEWEEK- ONEINSTRUCTION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Workspace checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Is Google Vault the same kind of thing as Microsoft Purview? Can deleted Gmail be recovered? How reliable are Google Docs revision histories as evidence? The space had history off. Is the chat genuinely gone? What happens to a departed employee's My Drive files? We are a Microsoft firm facing a Google-estate opponent. What do we ask first? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY