Page 1
TEAMSCHANNELEVIDENCE · A GUIDE FOR UK LAWYERS Collecting Evidence from Microsoft Teams Private and Shared Channels The Conversations That Live Outside the Team's Own Mailbox COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MICROSOFT 365 COLLECTIONS
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the team is not the channel 03 Where the data actually lives: standard, private and shared channels compared 04 Membership, lifecycle and what survives departures and deletions 05 Holds and collection: scoping so nothing is missed 06 Reconstruction, review and the shape of channel evidence 07 Proving completeness and challenging the opponent's collection 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PRIVATEANDSHAREDCHANNELSSTOREMESSAGESANDFILES SOME WHERE OTHER THAN THE TEAM ' SOWNMAILBOXANDSITE: A COLLECTION SCOPE D TOTHETEAMMISSESTHEM, ANDTHECENSUSTHATFINDSTHEMISTHEFIRSTTASK
§ 02 · FIRST PRINCIPLES The problem in plain English: the team is not the channel
§ 03 · THE STORAGE MAP Where the data actually lives: standard, private and shared channels compared
Page 2
§ 04 · LIFECYCLE Membership, lifecycle and what survives departures and deletions
§ 05 · HOLD S AND COLLECTION Holds and collection: scoping so nothing is missed 31.17 where the tests are met) started early where the material matters.
§ 06 · THE EVIDENCE ' SSHAPE Reconstruction, review and the shape of channel evidence 81 chat-unitisation decisions made explicitly and disclosed in the protocol (guide 94): reviewable, producible
§ 07 · COMPLETENESS Proving completeness and challenging the opponent's collection
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DIRECTORY / SIDE TENANT MEMBER PER- MAILBOXES CHANNEL DELETED/ (COMPLIANCE SHARE POINT RECOVERABLE COPIES) SITE ADMIN / CLIENT- EXTERNAL AUDIT LAYER CACHES (SHARED)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THERESTRUCTURINGCHANNELTHATWASNOTINTHEPRODUCTION EXAMPLE2 · THELEAVERPROCESSANDTHELASTCOPY EXAMPLE3 · THESHAREDCHANNELWITHANEXTERNALPARTNER
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · TEAMSCHANNEL PA R AG RAPHFORTHEDRD / PROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Teams channel checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions We collected the whole team. Why would private channels be missing? A private-channel member has left the company. Is their contribution lost? How do we know the census is complete? Can deleted private channels be recovered? The channel was shared with another company. Whose disclosure is it? Does this matter for small disputes, or only large investigations?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Collecting Evidence From Microsoft Teams Private And Shared Channels, Computer Forensics Lab, https://e-discovery.uk/library/collecting-evidence-from-microsoft-teams-private-and-shared-channels/pdf.