Page 1

DELETEDM365ACCOUNTS · A GUIDE FOR UK LAWYERS Recovering Evidence from Deleted Microsoft 365 User Accounts Soft Deletion, Inactive Mailboxes, Retention and the Leaver Who Left Before the Hold COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES DELETED-ACCOUNT RECOVERY

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the leaver process is a deletion engine 03 The lifecycle of a deleted account: soft deletion, inactive state, hard deletion 04 What survives where: mailbox, One Drive, Teams, audit logs and licences 05 Preservation and collection before and after the clocks run 06 When the account is gone: reconstruction from the rest of the estate 07 Leaver processes and preservation duties: the legal consequences 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ADELETEDMICROSOFT365ACCOUNTPASSESTHROUGH RECOVERABLESTATESWITHCLOCKSATTACHED: KNOWTHESTATE, ACTINSIDETHE CLOCK, ANDWHENTHECLOCKHASRUN, RECONSTRUCTFROMTHEESTATETHEUSER COULD NOT TAKE WITH THEM

§ 02 · FIRST PRINCIPLES The problem in plain English: the leaver process is a deletion engine

§ 03 · THELIFECYCLE The lifecycle of a deleted account: soft deletion, inactive state, hard deletion