Page 1

SHAREDMAILBOXES & DELEGATION · A GUIDE FOR UK LAWYERS Shared Mailboxes, Delegated Access and Who Really Sent the Email Attribution When the Sender Field Names an Inbox, Not a Person COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MAILBOX ATTRIBUTION ANALYSIS

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the From line is a label, not a signature 03 The access models: shared mailboxes, delegation, send-as and send-on-behalf 04 Rules, forwards and automation: mail that moves without a human 05 Collection: scoping shared and delegated mailboxes so nothing is missed 06 Attribution: proving which person acted from logs, permissions and devices 07 Compromise, misuse and the legal deployment of attribution findings 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: SHAREDANDDELEGATEDMAILBOXESSEPARATETHEMAILBOX FROM THE PER S ON: COLLECTTHEMAILBOXASITSOWNSOURCE, ANDATTRIBUTETHE ACTFROMTHEAUDITTRAIL, THEPERMISSIONHISTORYANDTHEDEVICE, NEVER FROM THEFROMLINEALONE

§ 02 · FIRST PRINCIPLES The problem in plain English: the From line is a label, not a signature

§ 03 · THE ACCESS MODEL S The access models: shared mailboxes, delegation, send-as and send-on-behalf