Frame a question that can be tested
An internal concern should be translated into specific propositions and relevant time periods. Examples include whether particular documents were sent externally, whether correspondence is missing from an agreed collection, or whether a shared mailbox was used around a disputed event. Findings should be tested against plausible innocent explanations.
Authority and scope come first
Company involvement does not remove the need to establish examination authority and relevant boundaries. The client and its legal advisers should address employee-monitoring issues, personal material, privilege, cross-border restrictions and the scope of any instructed review. Access to an account is not, by itself, confirmation that every use of its contents is authorised.
Potential inputs
Sources may include relevant mailbox material, local stores, authorised administrative records, shared mailboxes and available device artefacts. Each source has its own coverage and retention limitations.
- Identify custodians, aliases, delegates and service accounts.
- Supply the concern, relevant events and any known alternative explanation.
- Record preservation, departure, account-disablement and migration actions.
Possible findings and outputs
An agreed review may produce a chronology, an evidence schedule, message or attachment comparisons and a technical report. The report should distinguish an account event from the actions of a particular person, and identify whether collection gaps affect the findings. Search terms, exclusions and the review scope should be recorded.
Preservation and next step
Coordinate staff departure and account administration with proportionate preservation. Avoid unnecessary alterations to the only surviving source. Technical findings do not determine misconduct, employment liability or the legal outcome. Begin with the evidential questions and proposed authority so that the examination can be scoped with the responsible legal or internal team.