Email and Cloud Exfiltration Forensics

Material that leaves through a mailbox or a cloud account gets written down twice — once by the service and once by the machine — and a sound investigation reads both halves before it says anything. Rules, attachment history and sign-in patterns come out of the tenancy. Browser artefacts and sync-client logs come off the endpoint. The two are lined up into a single dated account. For professional firms, agencies and IT departments across Berkshire, Surrey and London.

Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.

// what usually prompts the call

What an exit through a mailbox looks like

Each of these has an innocent explanation on its own. Together they make a pattern worth examining.

Attachments growing steadily, all of them addressed to one private mailbox
A rule quietly forwarding mail outward, found only after the person left
Company accounts being signed into at three in the morning on a Sunday
A private OneDrive, Dropbox or Google Drive logged in on issued hardware
SharePoint or a team drive downloaded in bulk in somebody's last fortnight
The leaver's mailbox purged before a single person had looked inside it

How a mailbox behaves on the way out of the door

A mailbox being used to move material develops a recognisable manner. Attachments grow while the recipient list narrows to a single private address. A rule appears and starts pushing selected mail outward without anyone touching it, often into a folder nobody checks. The search history stops looking like the day's work and starts looking like hunting — client names, project titles, rate cards, tender numbers. Access drifts into evenings and Sunday afternoons. The platform records all of that as a matter of routine, and each element is retrieved, dated and attributed in the examination rather than described in general terms.

Sync clients keep a diary on the endpoint

The device supplies the half that people forget about. Browser artefacts show a personal cloud account being created and signed into from company hardware. The OneDrive client keeps its own diagnostic and activity logs under the user profile, recording which folders were set to mirror and from when. Dropbox and Google Drive keep local databases and cache folders that do the same work. The residue of an upload — cached pages, confirmation screens, recent-file lists, thumbnail caches — outlives a cleared browsing history by a long way, and the system resource usage database quietly totals how many bytes each application pushed out and when. A personal sync client that appears on a work machine in somebody's final month is rarely there by accident, and the log will say what it carried.

Evidence the platform gathers on your behalf

Microsoft 365 and Google Workspace build a case file whether anyone asks them to or not, and it frequently decides the matter outright. Mail movement, sharing and downloads land in the unified audit log and come out through Purview eDiscovery. Vault holds preserve Gmail and Drive content, while the admin console's Drive log puts an account and a timestamp against every share and every download. SharePoint and OneDrive record bulk retrieval. Dropbox keeps version history and recoverable deletions. The catch sits in the retention: these windows are measured in months rather than years, the exact figure follows the licence the business bought, and none of them pause while a decision is being taken upstairs.

Two accounts of the same minute

A finding convinces when it arrives from two directions at once. The tenancy shows 2.1 GB pulled down at 21:14. Three minutes later the same file names appear inside a personal sync folder on the laptop. The browser record joins the two ends together. Platform evidence and endpoint evidence go into one sequence, and where the two disagree the disagreement is put in the report rather than tidied out of it, because the expert on the other side is going to find it regardless. Everything captured — mailbox export, audit extract, disk image — is hashed before any account is suspended or any licence reclaimed. The order of those steps is not a detail.

The bench method behind all of it is at the forensic recovery hub. Credentials and server records carry on at insider threat forensics, the employer casework at employee data theft, and holding the material properly at legal hold and chain of custody. Ordinary recovery bands are on the prices page.

// what ends up in the report

Both ends of the exit, in one sequence

Platform records and endpoint artefacts, read against each other rather than reported separately.

Attachments

Size, recipient and date for everything that went to a private address.

Rules

Forwarding and delete rules, the date each was made, and what it caught after that.

Access pattern

Sign-in times and locations, with the out-of-hours clusters marked up.

Sync residue

Private accounts, mirrored folders and upload leftovers sitting on the laptop.

Audit extracts

Share, download and export events lifted from the tenancy's own logging.

Recovered mail

Individual messages and entire mailboxes brought back from hold or backup.

// paying for it, and being entitled to ask

What it costs, and who may instruct

Two figures, printed rather than hinted at

Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.

£800 + VAT

The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.

£400 + VAT

The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.

Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Several mailboxes, or a whole tenancy, is a larger scope and gets its own written quotation once the free diagnostic has closed. Everything that is not forensic keeps its published band on the prices page.

The footing an examination needs

Mailbox and cloud instructions run on tenancies and devices the company owns, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.

// getting the media to the bench

Booking a device in — what actually has to happen

Most cloud material is preserved by export rather than by parcel, so ring 0800 689 0668 and we will separate what can be captured remotely from what genuinely has to travel. Hardware reaches Guildford by tracked, insured post, or over the counter there in office hours. No part of this network collects and Bracknell has no counter. Custody is recorded from the moment it arrives.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.

// email and cloud — asked by IT

What IT managers ring about

Usually not, provided you raise it quickly. A deleted mailbox stays recoverable for a defined period afterwards, and a litigation hold or a backup stretches that a good deal further. What you cannot do is negotiate with the clock: the window runs whether or not anybody has made a decision, so preservation should start the day the question is first asked rather than after the meeting about it.
The rule's own configuration shows what it was built to catch. Message trace and audit records show what genuinely moved, for as long as those records remain inside their retention window. Once the window has closed, the material sitting at the receiving end on the endpoint usually covers the gap. The report attributes each conclusion to the source it came from, so the strength of it is visible rather than asserted.
No, and no employer can ask us to. Somebody's private account is outside your reach and outside ours. The work is confined to your half of the exchange — tenancy logging, endpoint artefacts, and anything a court later orders disclosed. Since a transfer marks both ends, your half is generally sufficient.
Secure it, but capture before you do. Export the mailbox, take the audit logs, image the machine, and reclaim licences or purge things only after that. Taking those steps in the wrong order has destroyed more email evidence than any departing employee has managed on purpose. Ring us before you start and we will talk your IT team through the order at no charge.

The tenancy remembers. Not indefinitely.

Retention runs to the platform's timetable, not to yours — ring the freephone before anything gets purged.