Separate service from application
Someone saying the email was in Outlook may mean classic Outlook, new Outlook, Outlook for Mac, a mobile application or a website. The account behind it may be Exchange Online, an on-premises server, Outlook.com or another provider. Record the actual service, account identity, client version and local files.
Do not transfer enterprise assumptions
An organisation's Exchange Online environment may provide separately authorised administrative and preservation sources. Their presence depends on permissions, licensing, configuration and retention. Consumer account access should not be described as access to enterprise eDiscovery or tenant-wide logs. The same visible email can therefore sit within very different surrounding evidence.
Build a source map
List the live account, relevant computers, locally retained files, existing exports, archives and other participants. For a disputed message, identify which source supplied each copy and how it was exported. Do not assume a local Outlook search covered every server folder or historical item. This source map helps decide whether targeted collection is proportionate or broader preservation is needed. Any proposed method remains subject to authority, technical feasibility and the condition of the material.
Sources & further reading
Primary references support the technical explanation. They do not establish D3 validation of a particular method.