Mailboxes / audit logs / transport rules
Email forensics: Microsoft 365, Google Workspace and legacy on-prem
Reviewed on .
Preserve and analyze mailboxes, audit logs, transport rules and journaled archives across Microsoft 365, Google Workspace, hybrid Exchange and legacy on-premise systems.
Get a free consultation
Email is the most common source of evidence in commercial matters, and the most commonly mishandled. We collect mailboxes with audit-log support so downstream review can reason about who did what, when, from where.
Common scopes: full mailbox preservation with unified audit log export, journal-archive extraction, transport-rule and mail-flow snapshots, calendar and contact preservation, and reconstructing the audit trail of a mailbox rule that hid inbound messages. See email and Microsoft 365 forensics for the standard scope.
For business-email-compromise (BEC) matters, pair with incident response and read our note on the first 24 hours of a BEC.
Related services
Related computer & drive forensics
Also examined for this kind of matter
Discuss this matter with GDF
Confidential intake reviewed by a New York examiner. Reference the deadline, the devices or accounts involved, and how counsel or IT wants to receive the initial call.
Prefer email? Use gdfleads@evestigate.com. 24/7 line: 877.504.3580.