Identify the service and the mailbox

Exchange Online is a hosted service within Microsoft 365. Exchange Server is deployed on infrastructure managed by an organisation or its provider. A hybrid environment can divide relevant material between them. Outlook is a client used to access accounts; its presence does not identify the server or the available administrator evidence.

  • Identify user, shared, delegated, archive and inactive mailboxes separately.
  • Record migrations, account changes and who administered the environment during the relevant period.

Potential evidence sources

An authorised mailbox collection may provide messages, attachments and recorded properties. Microsoft Purview search and export, holds, audit records and message tracing are distinct sources. Their permissions, coverage and retention need separate assessment. An export of search results should not be described as a complete account history.

  • Preserve collection queries, selected locations, date filters, errors and export reports.
  • Consider gateway records, local stores and other correspondents where the primary collection has gaps.

Deletion and retention require context

Exchange Online distinguishes deletion states and uses Recoverable Items in conjunction with features including deleted-item retention and holds. What survives depends on the actual configuration and history. A hold applied now cannot be assumed to recreate content already purged.

A missing search result is not proof that a message never existed. Check scope, permissions, indexing, encryption and collection errors before interpreting absence. An account event or delivery record alone does not identify the person who acted or prove that a recipient read the message.

Before collection

Identify the instructing party's authority, relevant custodians, dates, disputed propositions and administrative contact. Agree a preservation plan with the authorised IT team and legal advisers. Record necessary containment actions if an account is compromised; preserving evidence must be coordinated with account protection.

  • Avoid unnecessary mailbox deletion, licence changes, migration or retention changes while the collection plan is being agreed.
  • Do not send administrator passwords, recovery codes or tenant exports with an initial enquiry.

An agreed output

A scoped instruction may produce an acquisition record, item schedule, chronology, comparison or technical report. The report should distinguish collected content, observed events and inference, and identify sources not obtained. A feasibility assessment determines the collection route; vendor documentation does not establish D3's validation of every tenant, feature or version.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.