Preserve Native Messages and Available Audit Records
Counsel can start with the people, account types, relevant period and production deadline. We arrange access with the authorized account holder or administrator. Routine remote collection allows email users to keep working, which simplifies coordination with clients in apartments, home offices and workplaces across the region.
For Microsoft 365, the source list can include Outlook messages, attachments, OneDrive and SharePoint files and activity logs. A Gmail or Google Workspace matter may include messages, Google Drive documents and Workspace records. We identify the available sources and collection method for the actual account.
Tell us whether the case turns on a disputed message, forwarding, a communication pattern or company information sent outside the business. That question determines which supporting logs, recipient records and linked files belong in the examination.
The delivery plan can include an evidence inventory, authentication findings, a communication timeline and material for review or production. We coordinate formats and reporting with the New York retaining team and can provide expert support for deposition and testimony.
- New York cloud record coordination
- Employee email and file transfers
- Google Workspace examination methods
- Microsoft 365 forensic methods
Remote Collection While Email Stays in Use
Routine authorized collection allows continued account use. We coordinate access and the evidence scope with the account holder or administrator, then preserve the original messages and agreed supporting records.
Tell Us Which Messages Are Disputed
Name the mailboxes, the messages and the dates. We will plan a native collection that keeps the audit trail intact on a free call.
A screenshot or forwarded message strips away technical context. GDF preserves native messages and the records around them, then correlates mailbox, cloud, identity, transport, and endpoint data. The approach supports authenticity disputes, eDiscovery, account compromise, insider activity, and delivery questions.
Correlate Mailbox, Identity and Shared File Activity
Microsoft 365 and Google Workspace contain multiple evidence sources with different availability and retention periods. Mailbox contents, message trace data, unified audit logs, sign in events, inbox rules, OAuth grants, administrative changes, and security alerts each follow their own retention schedule. Availability depends on workload, license, audit configuration, retention policy, event age, and provider changes. A preservation plan records those conditions, legal holds, exports, and collection timestamps.
For litigation, the work can be aligned with eDiscovery data preservation and production requirements. For a security event, collection proceeds alongside containment so remediation does not erase the facts needed to understand entry, persistence, or misuse.
Authenticate, Correlate, Test
Email authentication results, routing headers, Message IDs, MIME structure, server timestamps, and domain controls are examined together. A header can be forged; the conclusion depends on the full path and corroborating records. For suspected business email compromise, analysts also look for session anomalies, malicious forwarding, application consent, credential resets, unusual access, and payment thread manipulation.
The scope covers native MSG, EML, PST, MBOX, and supported cloud collections; mailbox rule, forwarding, delegate, and permission review; Microsoft Entra and Google identity event correlation; phishing path, sender domain, and attachment analysis; and chronologies prepared for counsel, insurers, and response teams.
Findings That Match What the Record Shows
A successful login identifies an account event; to reach the person at the keyboard we look at the records around it. IP reputation, geolocation, device identifiers, multifactor records, and user agent data can narrow an explanation but may be shared, proxied, stale, or manipulated. Sender authentication rests on headers and authentication results beyond the display name. Reports separate established facts from inferences and identify any additional source worth examining.