Digital Forensics for Microsoft 365 & Google Workspace

What Is Cloud Digital Forensics?

Cloud digital forensics is the documented collection and analysis of audit, identity, email, and file-activity records from a cloud service after a suspected incident. For a Microsoft 365 or Google Workspace tenant, the goal is to reconstruct a timeline from the records the platform actually retained: who signed in, which settings changed, how messages moved, what files were accessed or shared, and which accounts or applications were involved. It is different from routine administration because the collection method, source, time, handler, and limitations are recorded so another decision-maker can understand what supports each finding. It is also different from a promise to recover everything. Licensing, retention, configuration, elapsed time, and actions taken after the event determine what evidence still exists, so a defensible investigation states both what the records establish and what they cannot establish.

IT Rapid Support focuses this service on Microsoft 365, Exchange Online, and Google Workspace evidence for business incidents. The result is a factual technical chronology for management, cyber insurers, and counsel—not a legal conclusion and not a guarantee that every deleted item or historical action can be recovered.

Microsoft 365 and Exchange Online Forensics

Microsoft 365 investigations start with the evidence sources that answer different parts of the event. Microsoft Purview audit records can include user and administrator operations across supported services. Exchange mailbox auditing can show events such as message access, SendAs or SendOnBehalf activity, and inbox-rule changes when those records are available. Exchange message trace follows mail flow within its retention window. Current and historical inbox rules, forwarding settings, mailbox delegation, transport configuration, and Purview content or eDiscovery searches help explain how a compromised account was used and what information may have been exposed.

Identity evidence matters just as much as mailbox evidence. We review the Entra ID sign-in and directory activity available to the tenant, including interactive and non-interactive sign-ins, source addresses, client applications, authentication results, and administrative changes. SharePoint and OneDrive audit events can add file access, download, deletion, sharing, and permission activity. The objective is a defensible timeline: how the account was accessed, what changed, which messages or files were involved, what the available records can establish, and where retention or licensing creates an evidence gap.

Google Workspace and Gmail Forensics

Google Workspace investigations use the Admin console audit and investigation data available to the organization. That can include administrator activity, login events, Gmail log search, Google Vault preservation and search, OAuth token and third-party application access, and Google Drive sharing or file-access activity. We correlate those sources instead of treating any single log as the whole story.

A Google Workspace review can identify suspicious logins, unauthorized mailbox or forwarding changes, risky OAuth grants, access by third-party applications, and unusual sharing or downloads. Availability depends on the organization's Workspace edition, audit settings, retention, and how quickly evidence is preserved, so scope begins with a source-and-retention check rather than a promise that every historical action can be recovered.

How a Cloud Forensic Investigation Works

First, scope and preserve. We identify the affected tenant, accounts, administrators, date range, known indicators, available licences, retention settings, and any legal or insurance instructions. Actions that could alter evidence are coordinated with containment rather than performed casually.

Second, collect and inventory. Relevant native exports and reports are gathered where practical, with source, method, time, account, filename or object, and handler recorded. Hashes are calculated for evidence files where that method applies, and custody transfers are logged.

Third, correlate and test. Sign-ins, mailbox events, message trace, rules, forwarding, delegation, OAuth access, and file activity are placed on one normalized timeline. A single IP address or log event is not treated as proof of a person; findings are tested against the other available sources.

Fourth, report and hand off. The report separates verified findings, interpretation, and unknowns, identifies affected identities or data supported by the evidence, records limitations, and lists containment or follow-up actions for the incident team, insurer, management, or counsel.

Business Email Compromise Investigation

Business email compromise is the most common reason to start: a mailbox sends fraudulent payment instructions, a hidden inbox rule diverts replies, or an attacker maintains access through forwarding, delegated permissions, or an OAuth application. We connect mail flow, mailbox activity, sign-ins, and configuration changes to determine the affected period and accounts, then tie the findings into containment and recovery through our cyber incident response service.

The questions are concrete: when did suspicious access begin, which authentication and client patterns were recorded, which rules or forwarding paths changed, which messages were sent or accessed, whether delegation or an application created another access path, and what evidence supports the end of the affected period. The investigation does not replace containment; it gives the response team a documented scope instead of relying on the first visible symptom.

Insider Data Theft, Departing Employees, and Ransomware Scoping

A departing-employee or suspected insider investigation asks what the available tenant records show before and after the relevant date: sign-ins, mailbox forwarding, external sharing, downloads, deletions, OAuth access, and administrative or permission changes. The records can establish activity tied to an account or application; they do not automatically establish who was physically at a keyboard or why an action occurred. That distinction belongs in the findings.

Ransomware scoping uses the same discipline when cloud identities or repositories may be involved. Entra ID or Google login activity, Microsoft 365 or Workspace audit events, mailbox changes, and file-access records can help establish which cloud accounts and data sources need attention. Endpoint containment, system recovery, and threat eradication remain part of incident response, while the forensic work preserves and reconstructs the evidence needed to understand the event.

Evidence Preservation, Chain of Custody, and Reporting

Collection is documented from the start: the tenant and source system, query or export method, date and time, account used, original filename or object, and the person handling it. Exports are retained in their native form where practical, and hashes are recorded for evidence files where that method applies. A chain-of-custody record documents who received or handled the material and why.

The report separates verified findings from interpretations and unknowns. It sets out the scope, evidence inventory, methods, timeline, affected identities or data, containment actions, limitations, and next steps. That format gives management a usable decision record and can be shared with cyber insurers, breach counsel, or litigation counsel without presenting legal conclusions that belong to counsel.

Digital Forensics vs Incident Response and eDiscovery

Digital forensics, incident response, and eDiscovery can touch the same tenant but answer different questions. Incident response is operational: contain the threat, remove access, restore systems, and reduce continuing harm. Digital forensics is evidentiary: preserve the available records, reconstruct what happened, test the scope, and document the support and limitations for each finding. The two streams often run together because a containment action can change evidence.

eDiscovery is collection and search for a legal matter under counsel's scope. A forensic investigation may use Purview eDiscovery, content search, Google Vault, or native exports as collection sources, but the forensic question is usually a chronology or incident hypothesis rather than legal responsiveness. IT Rapid Support can support documented collection and factual technical reporting; counsel controls legal strategy, privilege, responsiveness, and legal conclusions.

Managed security is the preventive and monitoring layer before an incident. Our managed security services reduce risk and watch for suspicious activity; this digital forensics service examines the retained evidence when the organization needs to establish what already happened.

What Evidence Limitations Mean in a Forensic Report

Cloud evidence is bounded by the tenant that produced it. Licence level, audit configuration, retention, the incident date, administrator actions, application behaviour, and any delay before preservation all affect what remains. A log can show that an account or application performed an action; it may not prove the identity or intent of the person behind it. An empty search can mean no recorded event, but it can also mean the event was outside retention or never logged by that source.

That is why the initial source-and-retention check matters. The final report identifies the systems and date ranges searched, the evidence found, the evidence expected but unavailable, time-zone handling, and any assumption needed to interpret the chronology. Unknowns are not filled with speculation. They are listed so management, the insurer, incident responders, and counsel can make decisions with the same boundary around the facts.

What to Do Before the Forensic Investigation Starts

The first hours after a suspected compromise decide how much evidence survives. Do not delete the affected user, mailbox, or suspicious messages, and do not wipe or rebuild a laptop that may be involved. Write down what was noticed, when, and by whom, and keep a list of every change made since, such as password resets, disabled accounts, or removed inbox rules, with the time each was made.

Containment still matters, and it should not wait for the investigation. Resetting a password, revoking sessions, or disabling forwarding can be done in a way that is recorded and coordinated with preservation, so the response team and the forensic work are not undoing each other. If your organization has cyber insurance, notify the insurer early, because many policies set out how incident response and investigation providers are engaged. Our cyber incident response page explains how containment runs alongside the investigation.

Scoping a Microsoft 365 Email Compromise Investigation

Scope sets what the investigation will examine and what question it is meant to answer. For a Microsoft 365 email compromise that usually means the mailboxes thought to be affected, the date range around the first suspicious activity, the known indicators such as a fraudulent payment request or an unfamiliar sign-in location, and the specific concern: payment fraud, exposure of client or personal information, or onward phishing sent from your domain.

The scope is agreed in writing before analysis begins and revisited if the evidence points elsewhere, for example to a second compromised account, a malicious application with mailbox permissions, or an administrator account. Expanding scope is a decision for the organization, not something that happens quietly, so the time and effort involved stay visible.

When Businesses Typically Ask for a Cloud Forensic Investigation

Most requests start from one of a few situations. A finance team discovers that a supplier or client paid money to the wrong account after an email that appeared genuine. Customers report receiving phishing messages sent from a real staff mailbox. An employee has left for a competitor and management wants to know what was shared, forwarded, or downloaded beforehand. Or an insurer, auditor, or counsel asks the organization to document what happened and which data was involved.

In each case the work is the same in principle: identify the evidence sources that still exist, preserve them, reconstruct the activity, and report findings with their limits. The investigation describes what the records show. Decisions about notification, recovery of funds, employment action, or legal steps remain with the organization and its advisers.

Audit and Retention Settings to Check Before You Need Them

Much of what a forensic investigation can establish is decided long before an incident, by how the tenant was configured. Before something goes wrong, confirm that Microsoft Purview audit logging is turned on, that mailbox auditing is active, what audit and sign-in retention your licences provide, and whether retention policies or holds apply to mail and files. In Google Workspace, check the edition's audit and investigation features and whether Vault retention is configured.

These settings cost little to review and can make the difference between a documented answer and an evidence gap. Reviewing them is part of the tenant administration we carry out for clients on our Microsoft 365 managed services, and the same review is the starting point when an incident has already occurred.

Do You Need Digital Forensics, or Is Containment Enough?

Not every security event needs a forensic investigation. A single phishing email that nobody acted on, or a password reset after a blocked sign-in attempt, is usually handled by containment and a short review. A documented investigation earns its cost when someone needs a factual answer about what happened: money was paid to the wrong account, client or patient information may have been exposed, customers received fraudulent messages from a real mailbox, a cyber insurer or lawyer has asked for a timeline, or management needs to know what a departing employee took.

If you are unsure which side of that line you are on, preserve first and decide afterwards. Keeping the mailbox, the messages and a record of every change costs very little, and it keeps the option of an investigation open. Deleting the account or rebuilding the laptop closes it permanently.

How a Digital Forensics Engagement Is Priced

Digital forensics is security work and is billed by the hour. The effort depends on the number of accounts involved, the length of the date range, which evidence sources are available and how many questions the investigation has to answer, so the scope is agreed in writing before analysis begins and revisited only with your approval if the evidence points somewhere new.

A narrowly scoped question, such as whether one mailbox had a forwarding rule added and when, takes far less time than reconstructing several months of activity across a tenant. Telling us early what decision the report needs to support, such as an insurance claim, a conversation with a client or an employment matter, helps keep the scope to the evidence that actually answers it.

Breach Notification Decisions: Where the Forensic Report Fits

Organizations subject to PIPEDA must report a breach of security safeguards involving personal information to the Office of the Privacy Commissioner of Canada and notify affected individuals when it creates a real risk of significant harm, and must keep a record of every such breach. Health information custodians in Ontario have their own notification duties under PHIPA. Whether those duties apply depends on facts, such as which records were accessed and by whom, that are often unknown in the first days after an incident.

A forensic report does not make that decision. It supplies the facts: which accounts and data the evidence shows were involved, over what period, and what the records cannot establish. The notification decision stays with the organization and its legal advisers, who can make it on documented evidence instead of assumptions.

After the Investigation: Closing the Gaps the Evidence Found

Most investigations end with a short list of causes that can be fixed: an account without multi-factor authentication, legacy sign-in methods still enabled, an application granted mailbox access nobody remembers approving, forwarding to outside addresses allowed by default, or audit retention too short to answer the next question. The report lists those findings so they can be closed in order of risk.

Closing them is ordinary security work rather than forensics. For organizations that want it handled on an ongoing basis, our managed security services cover the controls and monitoring, and Microsoft 365 managed services cover the tenant configuration. If an incident is still active, the cyber incident response line is available 24/7.

Digital Forensics Across the GTA and Ontario

IT Rapid Support is based at 7810 Keele Street in Vaughan and provides digital forensic services across the Greater Toronto Area and Ontario. The site's established service footprint includes Vaughan, Toronto, Mississauga, Brampton, Oakville, Markham, Richmond Hill, Burlington, and Hamilton.

Microsoft 365 and Google Workspace evidence collection is usually remote because the evidence sits in the cloud tenant, but an incident may also require endpoint triage or on-site coordination. The initial scope identifies the relevant accounts, devices, dates, administrators, legal or insurance contacts, and any action that could alter evidence before collection begins.