ZEKASTRA case pack VP-07 - acquisition log - SYNTHETIC TRAINING DATA

Case: Akyel Tekstil A.S. - payment to a changed bank account - internal reference AKY-2026-014
Collected by: incident response examiner, account ir.inceleme@akyeltekstil.example (Global Reader, Audit Reader roles)
All times UTC unless stated.

2026-07-13 09:40  Delta Perakende A.S. reports by telephone that the invoice 2026-0715 was paid on 9 July to the "new account". Akyel Tekstil has no new account.
2026-07-13 10:15  Delta forwards the message as an attachment and a copy of its bank receipt (iban-degisikligi.eml, odeme-dekontu.txt).
2026-07-13 10:52  Sessions of s.kaya revoked; password reset; the inbox rule ".." is kept in place, disabled, for the record.
2026-07-13 11:30  Purview Audit search started for the window stated in export-metadata.txt; completed 11:47; exported to CSV.
2026-07-13 11:55  Entra sign-in logs, interactive and non-interactive, downloaded for the same window; concatenated as stated.
2026-07-13 12:10  Exchange Online message trace exported for the same window.
2026-07-13 12:30  Hashes computed for every file and written to manifest.txt.

Time zone of the examiner's portal settings: UTC. The customer's receipt and the Received headers it added are in its local time.