Digital Forensics for Microsoft 365 & Google Workspace

What Is Cloud Digital Forensics?

Cloud digital forensics is the documented collection and analysis of audit, identity, email, and file-activity records from a cloud service after a suspected incident. For a Microsoft 365 or Google Workspace tenant, the goal is to reconstruct a timeline from the records the platform actually retained: who signed in, which settings changed, how messages moved, what files were accessed or shared, and which accounts or applications were involved. It is different from routine administration because the collection method, source, time, handler, and limitations are recorded so another decision-maker can understand what supports each finding. It is also different from a promise to recover everything. Licensing, retention, configuration, elapsed time, and actions taken after the event determine what evidence still exists, so a defensible investigation states both what the records establish and what they cannot establish.

IT Rapid Support focuses this service on Microsoft 365, Exchange Online, and Google Workspace evidence for business incidents. The result is a factual technical chronology for management, cyber insurers, and counsel—not a legal conclusion and not a guarantee that every deleted item or historical action can be recovered.

Microsoft 365 and Exchange Online Forensics

Microsoft 365 investigations start with the evidence sources that answer different parts of the event. Microsoft Purview audit records can include user and administrator operations across supported services. Exchange mailbox auditing can show events such as message access, SendAs or SendOnBehalf activity, and inbox-rule changes when those records are available. Exchange message trace follows mail flow within its retention window. Current and historical inbox rules, forwarding settings, mailbox delegation, transport configuration, and Purview content or eDiscovery searches help explain how a compromised account was used and what information may have been exposed.

Identity evidence matters just as much as mailbox evidence. We review the Entra ID sign-in and directory activity available to the tenant, including interactive and non-interactive sign-ins, source addresses, client applications, authentication results, and administrative changes. SharePoint and OneDrive audit events can add file access, download, deletion, sharing, and permission activity. The objective is a defensible timeline: how the account was accessed, what changed, which messages or files were involved, what the available records can establish, and where retention or licensing creates an evidence gap.

Google Workspace and Gmail Forensics

Google Workspace investigations use the Admin console audit and investigation data available to the organization. That can include administrator activity, login events, Gmail log search, Google Vault preservation and search, OAuth token and third-party application access, and Google Drive sharing or file-access activity. We correlate those sources instead of treating any single log as the whole story.

A Google Workspace review can identify suspicious logins, unauthorized mailbox or forwarding changes, risky OAuth grants, access by third-party applications, and unusual sharing or downloads. Availability depends on the organization's Workspace edition, audit settings, retention, and how quickly evidence is preserved, so scope begins with a source-and-retention check rather than a promise that every historical action can be recovered.

How a Cloud Forensic Investigation Works

First, scope and preserve. We identify the affected tenant, accounts, administrators, date range, known indicators, available licences, retention settings, and any legal or insurance instructions. Actions that could alter evidence are coordinated with containment rather than performed casually.

Second, collect and inventory. Relevant native exports and reports are gathered where practical, with source, method, time, account, filename or object, and handler recorded. Hashes are calculated for evidence files where that method applies, and custody transfers are logged.

Third, correlate and test. Sign-ins, mailbox events, message trace, rules, forwarding, delegation, OAuth access, and file activity are placed on one normalized timeline. A single IP address or log event is not treated as proof of a person; findings are tested against the other available sources.

Fourth, report and hand off. The report separates verified findings, interpretation, and unknowns, identifies affected identities or data supported by the evidence, records limitations, and lists containment or follow-up actions for the incident team, insurer, management, or counsel.

Business Email Compromise Investigation

Business email compromise is the most common reason to start: a mailbox sends fraudulent payment instructions, a hidden inbox rule diverts replies, or an attacker maintains access through forwarding, delegated permissions, or an OAuth application. We connect mail flow, mailbox activity, sign-ins, and configuration changes to determine the affected period and accounts, then tie the findings into containment and recovery through our cyber incident response service.

The questions are concrete: when did suspicious access begin, which authentication and client patterns were recorded, which rules or forwarding paths changed, which messages were sent or accessed, whether delegation or an application created another access path, and what evidence supports the end of the affected period. The investigation does not replace containment; it gives the response team a documented scope instead of relying on the first visible symptom.

Insider Data Theft, Departing Employees, and Ransomware Scoping

A departing-employee or suspected insider investigation asks what the available tenant records show before and after the relevant date: sign-ins, mailbox forwarding, external sharing, downloads, deletions, OAuth access, and administrative or permission changes. The records can establish activity tied to an account or application; they do not automatically establish who was physically at a keyboard or why an action occurred. That distinction belongs in the findings.

Ransomware scoping uses the same discipline when cloud identities or repositories may be involved. Entra ID or Google login activity, Microsoft 365 or Workspace audit events, mailbox changes, and file-access records can help establish which cloud accounts and data sources need attention. Endpoint containment, system recovery, and threat eradication remain part of incident response, while the forensic work preserves and reconstructs the evidence needed to understand the event.

Evidence Preservation, Chain of Custody, and Reporting

Collection is documented from the start: the tenant and source system, query or export method, date and time, account used, original filename or object, and the person handling it. Exports are retained in their native form where practical, and hashes are recorded for evidence files where that method applies. A chain-of-custody record documents who received or handled the material and why.

The report separates verified findings from interpretations and unknowns. It sets out the scope, evidence inventory, methods, timeline, affected identities or data, containment actions, limitations, and next steps. That format gives management a usable decision record and can be shared with cyber insurers, breach counsel, or litigation counsel without presenting legal conclusions that belong to counsel.

Digital Forensics vs Incident Response and eDiscovery

Digital forensics, incident response, and eDiscovery can touch the same tenant but answer different questions. Incident response is operational: contain the threat, remove access, restore systems, and reduce continuing harm. Digital forensics is evidentiary: preserve the available records, reconstruct what happened, test the scope, and document the support and limitations for each finding. The two streams often run together because a containment action can change evidence.

eDiscovery is collection and search for a legal matter under counsel's scope. A forensic investigation may use Purview eDiscovery, content search, Google Vault, or native exports as collection sources, but the forensic question is usually a chronology or incident hypothesis rather than legal responsiveness. IT Rapid Support can support documented collection and factual technical reporting; counsel controls legal strategy, privilege, responsiveness, and legal conclusions.

Managed security is the preventive and monitoring layer before an incident. Our managed security services reduce risk and watch for suspicious activity; this digital forensics service examines the retained evidence when the organization needs to establish what already happened.

What Evidence Limitations Mean in a Forensic Report

Cloud evidence is bounded by the tenant that produced it. Licence level, audit configuration, retention, the incident date, administrator actions, application behaviour, and any delay before preservation all affect what remains. A log can show that an account or application performed an action; it may not prove the identity or intent of the person behind it. An empty search can mean no recorded event, but it can also mean the event was outside retention or never logged by that source.

That is why the initial source-and-retention check matters. The final report identifies the systems and date ranges searched, the evidence found, the evidence expected but unavailable, time-zone handling, and any assumption needed to interpret the chronology. Unknowns are not filled with speculation. They are listed so management, the insurer, incident responders, and counsel can make decisions with the same boundary around the facts.

Digital Forensics Across the GTA and Ontario

IT Rapid Support is based at 7810 Keele Street in Vaughan and provides digital forensic services across the Greater Toronto Area and Ontario. The site's established service footprint includes Vaughan, Toronto, Mississauga, Brampton, Oakville, Markham, Richmond Hill, Burlington, and Hamilton.

Microsoft 365 and Google Workspace evidence collection is usually remote because the evidence sits in the cloud tenant, but an incident may also require endpoint triage or on-site coordination. The initial scope identifies the relevant accounts, devices, dates, administrators, legal or insurance contacts, and any action that could alter evidence before collection begins.