Platforms & clients
Distinguish the hosting service from the application and the available evidence source. Start with a core platform or explore the provider directory.
Original content baseline 6 November 2026 · Content revision 0.3
Managed Microsoft environments
A business mailbox can be one of several evidence sources. Assess the messages, administrator records, endpoints and retention history separately before deciding what can be established.
Read more →Clients, files and account evidence
The Outlook name covers different applications and account types. The first step is to identify the exact client, version, account provider and surviving files.
Read more →Managed Gmail and administrator sources
Google Workspace evidence depends on the organisation's configuration, access rights and retention history. Gmail content, Vault material and administrative records answer different questions.
Read more →Consumer accounts and surviving copies
An authorised personal Gmail export or a surviving device copy may help answer an evidential question. It does not provide the organisation-level sources available in a managed Workspace environment.
Read more →Servers, stores, queues and logs
Linux identifies an operating system, not a mail system. A useful examination starts by mapping the components that received, stored, delivered and displayed the relevant messages.
Read more →Provider and client sources
iCloud Mail is an email service. Apple Mail is an application that can access iCloud and other providers. The account, local material and backups should be assessed as separate sources.
Read more →Provider directory
22 enquiry categories, each subject to source and method assessment.
Read more →Start with the question
A brief account of the issue, the available sources and the relevant dates is enough to begin.