Page 1

TEAMSCHANNELEVIDENCE · A GUIDE FOR UK LAWYERS Collecting Evidence from Microsoft Teams Private and Shared Channels The Conversations That Live Outside the Team's Own Mailbox COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MICROSOFT 365 COLLECTIONS

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the team is not the channel 03 Where the data actually lives: standard, private and shared channels compared 04 Membership, lifecycle and what survives departures and deletions 05 Holds and collection: scoping so nothing is missed 06 Reconstruction, review and the shape of channel evidence 07 Proving completeness and challenging the opponent's collection 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PRIVATEANDSHAREDCHANNELSSTOREMESSAGESANDFILES SOME WHERE OTHER THAN THE TEAM ' SOWNMAILBOXANDSITE: A COLLECTION SCOPE D TOTHETEAMMISSESTHEM, ANDTHECENSUSTHATFINDSTHEMISTHEFIRSTTASK

§ 02 · FIRST PRINCIPLES The problem in plain English: the team is not the channel

§ 03 · THE STORAGE MAP Where the data actually lives: standard, private and shared channels compared