What may be examined
Identity and sign-ins
Available sign-in records, devices, sessions and administrative changes may help identify unusual access. A geolocated IP address describes network routing, not a verified person or physical location.
Files and collaboration
Versions, sharing changes, exports and audit events may help reconstruct access to business information. Permissions, service tier and retention affect the records available.
Collection methods
A scoped export through authorised platform features can preserve selected custodians, services and dates. Record the export settings, collector and collection time rather than relying on a folder of screenshots.
Before an examination
Identify the tenant or account owner, relevant custodians, discovery date and suspected period. Preserve available logs before retention expires. Coordinate urgent account protection with the incident lead so security actions and evidence collection are both documented.
What you can receive
The scope can provide an indexed export, collection notes, source-specific timelines and a summary of events supported by the records. Distinguish a successful sign-in from actual access to particular data.
What the evidence may not establish
Logs not recorded or already expired cannot be recreated simply by upgrading a licence. Provider-held information may require a separate legal process. An investigation does not grant access to another person’s accounts.
Questions before you begin
Not generally. Retention and licensing must be checked against the service and the event dates. A new subscription does not recreate records that were never collected or have expired.
Often, but collection can involve administrative changes or service constraints. Agree the method, impact and priorities with the organisation before work begins.