Forensic Collection Of Exchange Online Mailboxes

EXCHANGEONLINEEVIDENCE · AGUIDEFORUKLAWYERS Forensic Collection of Exchange Online Mailboxes Active, Archived, Deleted and Recoverable Mail: Reaching Every Layer of the Mailbox, with Metadata Intact COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the mailbox beneath the mailbox 03 Mailbox anatomy: the layers and what each holds 04 What deleted means, layer by layer 05 Collection: reaching every layer with metadata intact 06 Permissions, delegation and who-read-what 07 Message metadata and authenticity 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : AMAILBOXISALAYEREDSTORE , ANDMOST " DELETED " MAILIS ALAYERQUESTION § 0 2 · FIRSTPRINCIPLES The problem in plain English: the mailbox beneath the mailbox § 0 3 · ANATOMY Mailbox anatomy: the layers and what each holds LAYER WHAT IT HOLDS · HABITS THAT MATTER § 0 4 · DELETED , REALLY ? What deleted means, layer by layer § 0 5 · GETTINGITOUT Collection: reaching every layer with metadata intact § 0 6 · OTHERHANDS Permissions, delegation and who-read-what § 0 7 · ISITREAL ? Message metadata and authenticity § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE JOURNAL / + AUDIT MAILBOX CACHES COUNTERPART DELETED / STACK (OST/ TENANTS RECOVERABLE DEVICE MOBILE) BACKUP / TRANSPORT ARCHIVE LOGS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEPURGEPRESERVEDBYTHEHOLD EXAMPLE2 · THEARCHIVETHATHELDTHEMISSINGYEARS EXAMPLE3 · THEEMAILTHATEXISTEDINONLYONEMAILBOX § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · MAILB OX LIMBFORTHECOLLECTIONSPECIFIC AT ION § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The Exchange Online checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The custodian deleted emails months ago. Can they be recovered? Can a user or admin permanently destroy mail on a held mailbox? How do we prove the other side received and read an email? What about the OST file on the laptop: is it worth collecting? Are auto-forwarding rules really that significant? Our exhibit email is challenged as fabricated. What should we commission? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY