Email and Cloud Exfiltration Forensics

Material leaves a modern business through a mailbox and a browser far more often than it leaves on a stick. Two records describe that exit and neither is complete on its own: the tenancy's audit logging, which knows about sign-ins, shares and downloads, and the endpoint, which knows what a sync client actually wrote to disk. Read together they produce a sequence. Read separately they produce an argument.

Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.

// what an exit through a mailbox looks like

Six patterns worth a closer look

Any one of these has an innocent explanation on its own. Several of them in the same month is a pattern, and a pattern is what an examination is for.

A slow drip of attachments, every one to the same private account
An outbound forwarding rule found weeks after the person had gone
Corporate sign-ins timestamped at four in the morning at a weekend
A private Dropbox or Google Drive authenticated on a company laptop
An entire SharePoint library pulled down inside a single evening
A mailbox emptied before anyone had a chance to look through it

How a mailbox behaves on the way out of the door

Mail is the oldest route out and it is still the busiest. The patterns repeat: attachments addressed to a private account in ones and twos over several weeks, so no single send looks remarkable; a forwarding rule added quietly and often paired with a rule that deletes the forwarded copy so the sent items folder stays innocent; a burst of large sends in the last few days; and, at the end, a purge. What makes mail useful in an investigation is that almost none of it is under the sender's control. Message headers, transport logs, mailbox audit entries and the tenancy's own retention all sit outside the mailbox the sender can see and tidy.

Sync clients keep a diary on the endpoint

The cloud half of the story writes itself onto the laptop. OneDrive, Dropbox, Google Drive and Box all keep local databases recording which account is signed in, which folders are mirrored, what was uploaded and when, and what was subsequently removed. A personal account signed in beside the corporate one is one of the most productive single findings in this whole practice, because it usually means a mirrored folder somewhere on the disk with company documents inside it and an upload log attached. Browser records fill in the rest: transfer sites, webmail sessions, download history and the sign-in pages visited immediately beforehand.

Evidence the platform has gathered for you already

Microsoft 365 and Google Workspace both log a great deal more than most administrators realise, and it can be exported without any special access. Sign-in records with times, addresses and device details. File-level activity: opened, downloaded, shared, moved, deleted. Sharing links created, including anonymous ones. Mailbox rules, with the date each was created. Admin operations, such as somebody granting themselves rights over another mailbox. The catch is retention. Depending on the licence, some of this is held for ninety days and some for far less, which is why the export is the first thing done in these matters and why waiting to see whether the problem goes away is the single most expensive decision available.

Two accounts of the same minute

The value in doing both ends is corroboration. The tenancy says a document library was downloaded at 20:14 on the Tuesday; the laptop shows the account signed in, the browser session open, the archive written to the downloads folder and, twenty minutes later, a private cloud client uploading a folder of the same size. Neither record is conclusive alone. Together they are difficult to explain away, and where the two disagree the report says so rather than picking the one that suits the instruction better.

The handling underneath all of this is at the forensic recovery hub. The endpoint half is captured properly at workstation deep imaging, credentials and access run on at insider threat forensics, and if proceedings are in prospect the preservation obligations start at legal hold and chain of custody.

// both ends, in one sequence

What comes out of a tenancy and a laptop together

Each entry carries its own date and its source, and the two sources are shown separately so they can be compared.

Outbound files

Every attachment that reached a private mailbox, with its size and its date.

Rule history

When each forwarding or delete rule was created, and what it caught after that.

Sign-in shape

Times, addresses and devices, with the out-of-hours clusters called out.

Client residue

Personal accounts, mirrored folders and upload leftovers sitting on the disk.

Tenancy audit

Share, download and export events exported from the platform's own logging.

Restored mail

Messages and complete mailboxes brought back out of hold or from backup.

// what it costs, and who is entitled to ask

The fee, and the authority behind the instruction

Two figures, published rather than implied

The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.

£800 + VAT

The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.

£400 + VAT

The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.

Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Anything that is not forensic keeps the band it has always had on the prices page.

The footing an examination has to stand on

Tenancy and mailbox work is done on the company's own systems, with the company's authority, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.

// how the media reaches Cambridge

Sending a device — and the three exceptions

Most of a tenancy investigation happens on your own systems, so ring 0800 689 0668 first and we will settle what has to be exported and by when. Where a laptop also needs capturing it comes to Cambridge by tracked, insured post or across the counter there in office hours; nothing is collected anywhere in this network and Leicester has no counter of its own.

The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.

  • A stiff box or a well-padded mailer, with enough packing that nothing moves when you shake it. Power supplies, docks and cables can stay at home unless the drive is one of the WD units above.
  • Running a RAID or a server? Send the member disks on their own, not the chassis or the controller, and write the bay order on each one — 1, 2, 3 and so on. Photograph the front of the unit before you pull anything, because that photograph occasionally saves a day of work.
  • Fill in the shipping and booking-in form (PDF) — a name, a number you actually answer, and a line on how the trouble started — and put it in the box.
  • Special Delivery is tracked and insured and is what most people use; your own courier is equally fine. Handing it over in person also works: reception at the Cambridge address takes devices across the counter, Mon–Fri 9:00am–5:30pm. What does not exist is a Leicester counter or anyone who comes to collect.
// write this on the label

Cambridge Data Recovery

Compass House
Vision Park, Chivers Way
Cambridge, CB24 9AD

↓ Print the shipping & booking-in form (PDF)

Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.

Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.

// mailboxes and tenancies — before instructing

What clients ask about an export

Often not. A deleted mailbox is usually recoverable inside the tenancy's own retention window, and where litigation hold or an equivalent retention policy was on, the contents may have been preserved regardless of what anyone did to the visible folders. Backups and journal archives provide a third route. The window is finite and shorter than people expect, so the export is arranged first and the argument about scope afterwards.
In most cases yes. The rule itself carries a creation date, and message tracking or transport logs record what matched it after that, message by message. Where the sender also had the forwarded copies deleted automatically, the sent items folder will look clean while the transport record is not, and the contrast between the two is often the most telling exhibit in the file.
No, and nobody lawfully can. Somebody else's private account is out of reach without their consent or a court order directed at them or at the provider. What is in reach is everything the company's own systems and its own hardware recorded about the transfer — which account was signed in on your laptop, which folders it mirrored, what was uploaded and at what time. That is usually enough, and it is obtained without stepping over the Computer Misuse Act 1990.
Take advice before you touch it, because the instinct and the right answer sometimes differ. Disabling an account can stop further loss and can equally trigger retention timers or cut off logging you were about to need. The usual sequence is to preserve first — export the audit records, place the mailbox on hold, image the laptop — and to change access afterwards, on a plan rather than in a panic.

The tenancy remembers. But not indefinitely.

Audit logging expires on a schedule nobody chose. Ring the freephone and get the export arranged before the window closes on it.