Agree what needs to survive

Preservation begins with the question to be answered and the sources at risk. A targeted collection of particular messages may be proportionate, while a wider dispute may require broader preservation before filtering. The agreed approach should address custodians, time periods, accounts, devices, archives and relevant administrative records.

Inputs and prerequisites

The initial assessment needs the platform and account type, available authority, administrator access where relevant, known retention settings and any forthcoming deletion or migration. Credentials and recovery material should only be handled through an agreed procedure.

  • Identify live mailboxes, supplied exports and independent copies separately.
  • Record account and device changes already made.
  • Identify potential confidentiality or privilege boundaries with the instructing team.

Document the collection

The collection record should identify the source, custodian, scope, method, settings, times and analysis timezone. Errors, retries, exclusions and transformations matter. Hashes of source exports and derived files should be recorded separately so that later comparisons concern the correct objects.

What the deliverable may contain

Depending on the instruction, outputs may include preserved native material, a source inventory, a hash schedule, an acquisition report and an omissions or exceptions log. A technical collection report describes what was obtained; it does not automatically provide an opinion on every message.

Important limitations and next step

A cloud export is not automatically a complete account history or a forensic image. Permissions, filters, indexing, encryption and provider behaviour can affect coverage. Later preservation cannot recreate material already irretrievably lost. Coordinate necessary incident containment with preservation and record changes. Begin with a source inventory and the relevant deadlines so that feasible collection routes can be assessed.

Sources & further reading

Primary references support the technical explanation. They do not establish D3 validation of a particular method.