Collecting Evidence From Microsoft Teams Private And Shared Channels

TEAMSCHANNELEVIDENCE · AGUIDEFORUKLAWYERS Collecting Evidence from Microsoft Teams Private and Shared Channels The Conversations That Live Outside the Team's Own Mailbox COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MICROSOFT 365 COLLECTIONS § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the team is not the channel 03 Where the data actually lives: standard, private and shared channels compared 04 Membership, lifecycle and what survives departures and deletions 05 Holds and collection: scoping so nothing is missed 06 Reconstruction, review and the shape of channel evidence 07 Proving completeness and challenging the opponent's collection 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PRIVATEANDSHAREDCHANNELSSTOREMESSAGESANDFILES SOMEWHEREOTHERTHANTHETEAM ' SOWNMAILBOXANDSITE : ACOLLECTIONSCOPED TOTHETEAMMISSESTHEM , ANDTHECENSUSTHATFINDSTHEMISTHEFIRSTTASK § 0 2 · FIRSTPRINCIPLES The problem in plain English: the team is not the channel § 0 3 · THESTORAGEMAP Where the data actually lives: standard, private and shared channels compared § 0 4 · LIFECYCLE Membership, lifecycle and what survives departures and deletions § 0 5 · HOLDSANDCOLLECTION Holds and collection: scoping so nothing is missed 31.17 where the tests are met) started early where the material matters. § 0 6 · THEEVIDENCE ' SSHAPE Reconstruction, review and the shape of channel evidence 81 chat-unitisation decisions made explicitly and disclosed in the protocol (guide 94): reviewable, producible § 0 7 · COMPLETENESS Proving completeness and challenging the opponent's collection § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DIRECTORY / SIDE TENANT MEMBER PER- MAILBOXES CHANNEL DELETED/ (COMPLIANCE SHAREPOINT RECOVERABLE COPIES) SITE ADMIN / CLIENT- EXTERNAL AUDIT LAYER CACHES (SHARED) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THERESTRUCTURINGCHANNELTHATWASNOTINTHEPRODUCTION EXAMPLE2 · THELEAVERPROCESSANDTHELASTCOPY EXAMPLE3 · THESHAREDCHANNELWITHANEXTERNALPARTNER § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · TEAMSCHANNEL PA R AG RAPHFORTHEDRD / PROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Teams channel checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions We collected the whole team. Why would private channels be missing? A private-channel member has left the company. Is their contribution lost? How do we know the census is complete? Can deleted private channels be recovered? The channel was shared with another company. Whose disclosure is it? Does this matter for small disputes, or only large investigations? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY