Source register
References used in the technical content. Documentation supports a feature or distinction; it does not validate an examination route for D3.
Original content baseline 6 November 2026 · Content revision 0.3
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Deletion-state distinctions and configuration-dependent retained material.
Limitations: Does not establish this tenant's settings, surviving content or D3 capability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Search, export and preservation are separate configured functions.
Limitations: Entitlement, permissions and specific collection completeness require separate verification.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Permissions can restrict searchable mailbox populations and content.
Limitations: No tenant-specific access or D3 validation is established.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Version-dependent export routes, cache scope and excluded account settings.
Limitations: Current documentation does not establish historical-client behaviour. Do not follow routine cleanup recommendations on evidence.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: PST and OST roles in applicable Outlook account configurations.
Limitations: Not a universal statement about all Outlook clients or forensic recoverability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: PST handling has client and architecture prerequisites.
Limitations: Installed build and version must be checked; routine opening is not prescribed for original evidence.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Retention rules and holds affect what remains and what is purged.
Limitations: No claim that Vault is universal backup or that a later hold recreates purged data.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Exports are query-based collections with defined scope.
Limitations: Does not establish an account's entitlement, actual coverage or historical completeness.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Exportable message content, headers, attachments and labels, subject to available data.
Limitations: No complete-history or deleted-data recovery claim; encrypted messages can remain encrypted.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Authorised account-export process and Gmail label representation.
Limitations: Account access, selected products and export state still require recording.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Configurable mailbox formats, paths and separate index locations.
Limitations: Documentation is for a named version; no assumption about an examined server's configuration.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Transport, queue and delivery components are distinct from mailbox storage.
Limitations: Does not establish message retention or a complete journal.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Transport logging and configurable log locations.
Limitations: Actual logging level, rotation and surviving historical logs require examination.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Webmail role with separate IMAP and SMTP services.
Limitations: A webmail installation is not evidence of a complete local mailbox.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Apple Mail supports mailbox export in mbox format.
Limitations: Official search excerpt checked; direct fetch rate-limited. Full workflow and tested version require release verification.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Provider information and local copies should be considered separately.
Limitations: Routine user backup guidance does not establish forensic completeness or recoverability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Documented authorised export routes exist.
Limitations: Does not establish deletion recovery, encryption bypass or D3 validation.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Message structure, date and identifier field semantics.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: SMTP routing and trace context.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: MIME body and attachment representation.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Domain signing and signed-element boundaries.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Domain authorisation scope.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Current DMARC domain alignment and attribution boundaries.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Client-dependent PST support.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Offline data-file context.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Synchronisation scope can limit local content.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: MSG represents structured Outlook items.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: mbox storage and implementation context.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Maildir structure and metadata differences.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Exchange Online deletion and preservation dependencies.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Workspace retention and hold dependencies.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Vault supported functions and permissions context.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Authorised Gmail export availability.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Account export and representation context.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Collection scope, options and partial completion status.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Indexing limitations and separate export decisions.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Cloud link collection and version considerations.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Distinct access and sending permissions.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Source for investigating shared-mailbox activities.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Authorised export routes, not encryption defeat.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: General forensic process context, not an email-specific capability standard.
Limitations: Documentation is not D3 validation or a guarantee that a particular account contains accessible evidence. Recheck applicable version, configuration, authority and acquisition method.
Checked 2026-11-07 · Method feasibility is assessed for each instruction
Supports: FAQ: Can I rely on an Authentication-Results header saying dkim=pass?
Limitations: Primary guidance supports the stated technical distinction. It does not establish D3 validation of a particular method.
Checked 2026-11-07 · Method feasibility is assessed for each instruction
Supports: FAQ: Can you prove that an email was delivered or read?
Limitations: Primary guidance supports the stated technical distinction. It does not establish D3 validation of a particular method.
Checked 2026-11-07 · Method feasibility is assessed for each instruction
Supports: FAQ: Can you prove that an email was delivered or read?
Limitations: Primary guidance supports the stated technical distinction. It does not establish D3 validation of a particular method.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Evidence matrix: Mailbox export. Messages and selected metadata within the account, folders, query and format actually collected.
Limitations: An export is not automatically a full forensic image or a complete account history. Attachments that are links may require separate collection. Provider documentation does not confirm D3 capability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Evidence matrix: Local mail store. Locally held email and client artefacts, potentially including PST, OST, mbox or Maildir data.
Limitations: A cache can contain only part of a mailbox. Its absence does not establish absence from the service or another device. Provider documentation does not confirm D3 capability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Evidence matrix: Authorised tenant audit data. Recorded account or mailbox operations, identities and times within the available audit scope.
Limitations: A recorded account operation does not alone identify the human actor. Not every event records message content. Provider documentation does not confirm D3 capability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Evidence matrix: Transport and gateway logs. Recorded acceptance, routing, rejection or delivery events, addresses and identifiers where logged.
Limitations: A delivery event is not proof that a named person read the message. Logs may not retain the body or attachments. Provider documentation does not confirm D3 capability.
Checked 2026-11-06 · Method feasibility is assessed for each instruction
Supports: Evidence matrix: Backup. Historical mailbox, server or endpoint data within the actual backup scope and successful restore point.
Limitations: A backup is a snapshot or series of copies, not an assured record of every intermediate message. Restore to a separate working environment. Provider documentation does not confirm D3 capability.
Start with the question
A brief account of the issue, the available sources and the relevant dates is enough to begin.