01Purpose and scope
To capture cloud and email evidence before retention windows expire or remediation alters it, in a form whose origin and completeness can be shown.
Microsoft 365, Google Workspace and comparable services; IaaS activity trails and snapshots; on-premises mail servers; mailbox stores on endpoints.
02Prerequisites
- Written authority naming the tenant, the accounts and the data categories, and the administrative role to be used.
- A dedicated examiner account or a logged administrative session, so that examiner actions are distinguishable in the audit log.
- Knowledge of the service's retention and licence limits for each log type, from its documentation.
03Steps
Record the starting position
Date and time (UTC), examiner account and role, licence tier, which audit features are enabled, and the retention period of each log type as documented by the provider.
RecordPreservation record header.
Apply holds and extend retention
Place litigation or legal holds on the accounts and sites in scope; extend audit log retention where the licence permits. Export the hold configuration as proof, with time and account.
RecordHold configuration export.
Export logs for the full available window
Sign-in logs, unified audit logs, mailbox audit, admin audit, OAuth consent logs, file activity. Export in the provider's raw format (JSON or CSV with all columns), by API where possible. Record the exact query, filters, time range and result count for each export.
RecordExport log: query, range, count, file, hash.
Export content with fidelity
Mailboxes via the service's eDiscovery export (PST/EML with internet headers), drives with metadata and version history where offered, chat with thread context. Do not forward or download through a user client.
RecordContent export entries with hashes.
Hash and register every export
Compute SHA-256 of each export file on receipt; register it as a digital evidence item with its own custody record (SOP-03).
RecordDigital custody records.
Document the gaps
Logs that were not enabled, periods beyond retention, features unavailable at the licence tier, exports that returned partial results. Cite the provider's documentation for each.
RecordGap list with citations.
04Records produced
- Preservation record (starting position, holds, exports, gaps)
- Export log with queries and hashes
- Digital custody records per export
05Pitfalls
- Opening a spreadsheet application on a CSV export and saving it changes time formats and encodings; keep the original file untouched.
- Remediation before preservation (password reset, token revocation, mailbox purge) destroys the very records that show what the intruder did.
- Exports made with a shared administrator account cannot be distinguished from other administrators' actions.
- Provider-side 'location' fields are IP estimates and must be labelled as such when exported.