Recovering Evidence From Deleted Microsoft 365 User Accounts

DELETEDM365ACCOUNTS · AGUIDEFORUKLAWYERS Recovering Evidence from Deleted Microsoft 365 User Accounts Soft Deletion, Inactive Mailboxes, Retention and the Leaver Who Left Before the Hold COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES DELETED-ACCOUNT RECOVERY § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the leaver process is a deletion engine 03 The lifecycle of a deleted account: soft deletion, inactive state, hard deletion 04 What survives where: mailbox, OneDrive, Teams, audit logs and licences 05 Preservation and collection before and after the clocks run 06 When the account is gone: reconstruction from the rest of the estate 07 Leaver processes and preservation duties: the legal consequences 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : ADELETEDMICROSOFT365ACCOUNTPASSESTHROUGH RECOVERABLESTATESWITHCLOCKSATTACHED : KNOWTHESTATE , ACTINSIDETHE CLOCK , ANDWHENTHECLOCKHASRUN , RECONSTRUCTFROMTHEESTATETHEUSER COULDNOTTAKEWITHTHEM § 0 2 · FIRSTPRINCIPLES The problem in plain English: the leaver process is a deletion engine § 0 3 · THELIFECYCLE The lifecycle of a deleted account: soft deletion, inactive state, hard deletion § 0 4 · WHATSURVIVESWHERE What survives where: mailbox, OneDrive, Teams, audit logs and licences § 0 5 · BEATINGTHECLOCKS Preservation and collection before and after the clocks run § 0 6 · AFTERTHECLOCKS When the account is gone: reconstruction from the rest of the estate § 0 7 · THELEGALFRAME Leaver processes and preservation duties: the legal consequences § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAILBOX RETENTION DIRECTORY SOFT- DELETED / COUNTERPARTS + BACKUPS RESTORED SHARED STORES + DEVICES USER INACTIVE ONEDRIVE AUDIT / (HOLD) STAGE LAYER § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THERESTOREONDAYTWENTY - SIX EXAMPLE2 · THECUSTODIANREBUILTFROMEVERYONEELSE EXAMPLE3 · THELEAVERPROCESSTHATRANAFTERTHELETTER § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider ANDPOLICIES § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The deleted-account checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions IT deleted the account last week. Is the data gone? What is an inactive mailbox and how do we get one? The account was hard-deleted a year ago with no hold. What now? Our leaver process deleted a relevant account after the dispute began. How bad is it? Doesn't UK GDPR require us to delete leavers' data? Can we tell whether the opponent's deleted custodian is really unrecoverable? § 1 4 · REFERENCE Glossary Sources and authoritative references 31 · CPR Part 35: justice.gov.uk, Part DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY