Identify what was shared
Preserve the message and distinguish embedded files, inline content, linked documents and embedded messages. A familiar attachment icon is not enough to establish that the document's bytes are contained in the export. Record filenames, link targets, available identifiers and the method used to collect any associated files.
Ask which version matters
The file visible today may differ from the version available when the email was sent. Where authorised and technically available, examine version history, sharing records and retained versions. Microsoft describes specific cloud-attachment collection options and limitations; this does not mean every mailbox export includes the relevant historical document.
Preserve the relationship
Keep the parent message connected to each collected attachment or linked item, recording acquisition time and provenance. For a disputed bank instruction, comparing the presently linked document alone may miss a historical change. State whether the examined file was embedded, collected later from a live link or obtained from a historical version. If the earlier content cannot be established, report that limitation instead of treating the current document as evidence of exactly what the recipient saw.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.