Page 1
SHAREDMAILBOXES & DELEGATION · A GUIDE FOR UK LAWYERS Shared Mailboxes, Delegated Access and Who Really Sent the Email Attribution When the Sender Field Names an Inbox, Not a Person COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MAILBOX ATTRIBUTION ANALYSIS
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the From line is a label, not a signature 03 The access models: shared mailboxes, delegation, send-as and send-on-behalf 04 Rules, forwards and automation: mail that moves without a human 05 Collection: scoping shared and delegated mailboxes so nothing is missed 06 Attribution: proving which person acted from logs, permissions and devices 07 Compromise, misuse and the legal deployment of attribution findings 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: SHAREDANDDELEGATEDMAILBOXESSEPARATETHEMAILBOX FROM THE PER S ON: COLLECTTHEMAILBOXASITSOWNSOURCE, ANDATTRIBUTETHE ACTFROMTHEAUDITTRAIL, THEPERMISSIONHISTORYANDTHEDEVICE, NEVER FROM THEFROMLINEALONE
§ 02 · FIRST PRINCIPLES The problem in plain English: the From line is a label, not a signature
§ 03 · THE ACCESS MODEL S The access models: shared mailboxes, delegation, send-as and send-on-behalf
Page 2
§ 04 · MAILWITHOUTHANDS Rules, forwards and automation: mail that moves without a human 95
§ 4's selectivity) frequently the most telling fact in the case.
§ 05 · COLLECTION Collection: scoping shared and delegated mailboxes so nothing is missed
§ 06 · WHOACTED Attribution: proving which person acted from logs, permissions and devices
§ 07 · DEPLOYMENT Compromise, misuse and the legal deployment of attribution findings
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives QUESTION MAILBOX AUDIT CONFIGURATION SESSION COUNTERPART THE MAILBOX PERMISSION / SIGN-IN / RECIPIENT + ITSELF LOG LAYER LAYER COPIES END POINT ARTEFACTS
Page 3
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEAPPROVALTHEFINANCEDIRECTORNEVERGAVE EXAMPLE2 · THESHAREDMAILBOXTHATWASNEVERCOLLECTED EXAMPLE3 · THERULECREATEDAT02: 1
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider PROTOCOL
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The shared and delegated mailbox checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The email came from the executive's address. Isn't that proof she sent it? Why would a shared mailbox be missed in disclosure? What is the difference between send-as and send-on-behalf, and why does it matter? Can we prove who created a forwarding rule? Mailbox audit logging was off. Is attribution impossible? The assist an t sent it under standing instructions. Does attribution even matter?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
Page 4
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Shared Mailboxes Delegated Access And Who Really Sent The Email, Computer Forensics Lab, https://e-discovery.uk/library/shared-mailboxes-delegated-access-and-who-really-sent-the-email/pdf.