Shared Mailboxes Delegated Access And Who Really Sent The Email

SHAREDMAILBOXES & DELEGATION · AGUIDEFORUKLAWYERS Shared Mailboxes, Delegated Access and Who Really Sent the Email Attribution When the Sender Field Names an Inbox, Not a Person COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MAILBOX ATTRIBUTION ANALYSIS § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the From line is a label, not a signature 03 The access models: shared mailboxes, delegation, send-as and send-on-behalf 04 Rules, forwards and automation: mail that moves without a human 05 Collection: scoping shared and delegated mailboxes so nothing is missed 06 Attribution: proving which person acted from logs, permissions and devices 07 Compromise, misuse and the legal deployment of attribution findings 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : SHAREDANDDELEGATEDMAILBOXESSEPARATETHEMAILBOX FROMTHEPERSON : COLLECTTHEMAILBOXASITSOWNSOURCE , ANDATTRIBUTETHE ACTFROMTHEAUDITTRAIL , THEPERMISSIONHISTORYANDTHEDEVICE , NEVERFROM THEFROMLINEALONE § 0 2 · FIRSTPRINCIPLES The problem in plain English: the From line is a label, not a signature § 0 3 · THEACCESSMODELS The access models: shared mailboxes, delegation, send-as and send-on-behalf § 0 4 · MAILWITHOUTHANDS Rules, forwards and automation: mail that moves without a human 95 §4's selectivity) frequently the most telling fact in the case. § 0 5 · COLLECTION Collection: scoping shared and delegated mailboxes so nothing is missed § 0 6 · WHOACTED Attribution: proving which person acted from logs, permissions and devices § 0 7 · DEPLOYMENT Compromise, misuse and the legal deployment of attribution findings § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION MAILBOX AUDIT CONFIGURATION SESSION COUNTERPART THE MAILBOX PERMISSION / SIGN-IN / RECIPIENT + ITSELF LOG LAYER LAYER COPIES ENDPOINT ARTEFACTS § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEAPPROVALTHEFINANCEDIRECTORNEVERGAVE EXAMPLE2 · THESHAREDMAILBOXTHATWASNEVERCOLLECTED EXAMPLE3 · THERULECREATEDAT02 : 1 § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider PROTOCOL § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The shared and delegated mailbox checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions The email came from the executive's address. Isn't that proof she sent it? Why would a shared mailbox be missed in disclosure? What is the difference between send-as and send-on-behalf, and why does it matter? Can we prove who created a forwarding rule? Mailbox audit logging was off. Is attribution impossible? The assistant sent it under standing instructions. Does attribution even matter? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY