Forensic Collection Of Exchange Online Mailboxes
EXCHANGEONLINEEVIDENCE · A GUIDE FOR UK LAWYERS Forensic Collection of Exchange Online Mailboxes Active, Archived, Deleted and Recoverable Mail: Reaching Every Layer of the Mailbox, with Metadata Intact COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the mailbox beneath the mailbox 03 Mailbox anatomy: the layers and what each holds 04 What deleted means, layer by layer 05 Collection: reaching every layer with metadata intact 06 Permissions, delegation and who-read-what 07 Message metadata and authenticity 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: AMAILBOXISALAYEREDSTORE, ANDMOST " DELETED " MAILIS ALAYERQUESTION
§ 02 · FIRST PRINCIPLES The problem in plain English: the mailbox beneath the mailbox
§ 03 · ANATOMY Mailbox anatomy: the layers and what each holds LAYER WHAT IT HOLDS · HABITS THAT MATTER
§ 04 · DELETED, REALLY? What deleted means, layer by layer
§ 05 · GETTINGITOUT Collection: reaching every layer with metadata intact
§ 06 · OTHERHANDS Permissions, delegation and who-read-what
§ 07 · ISITREAL? Message metadata and authenticity
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE JOURNAL / + AUDIT MAILBOX CACHES COUNTERPART DELETED / STACK (OST/ TENANTS RECOVERABLE DEVICE MOBILE) BACKUP / TRANSPORT ARCHIVE LOGS
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEPURGEPRESERVEDBYTHEHOLD EXAMPLE2 · THEARCHIVETHATHELDTHEMISSINGYEARS EXAMPLE3 · THEEMAILTHATEXISTEDINONLYONEMAILBOX
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · MAILB OX LIMBFORTHECOLLECTIONSPECIFIC AT ION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Exchange Online checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The custodian deleted emails months ago. Can they be recovered? Can a user or admin permanently destroy mail on a held mailbox? How do we prove the other side received and read an email? What about the OST file on the laptop: is it worth collecting? Are auto-forwarding rules really that significant? Our exhibit email is challenged as fabricated. What should we commission?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Forensic Collection Of Exchange Online Mailboxes, Computer Forensics Lab, https://e-discovery.uk/library/forensic-collection-of-exchange-online-mailboxes/pdf.