Cloud Collaboration and Enterprise Application Forensics

What it is and why it matters

The office has moved into a few large platforms. Mail, files, chat, meetings and calendars sit in Microsoft 365 or Google Workspace. Teams talk in Slack. Customers live in a CRM, money in an ERP, tickets in a service desk. None of these systems gives an examiner a disk to image. What they give instead is an audit log of actions, an administrator's console for holds and exports and a set of retention rules that decide how far back anyone can look.

The investigation therefore starts with the audit log. Microsoft 365 records user and administrator operations across Exchange, SharePoint, OneDrive, Teams and Entra ID in one unified audit log. Google Workspace keeps log events for admin actions, Drive, Gmail, login and the rest, with Vault for retention, holds and export. Slack, Zoom, Salesforce, SAP and the others each have their own audit features, with their own gaps. The examiner learns each platform's log, knows what it does not record and reads it as a provider-generated business record rather than evidence they acquired themselves.

Because the organisation owns the tenant, it can authorise an examination of its own data under its policies. That authority is not unlimited. Staff have privacy rights under the Digital Personal Data Protection Act, 2023 and, for a workforce abroad, under laws such as the General Data Protection Regulation. Investigations should be scoped to the people, services and period that the matter needs, and the people who run them should be able to show that scope later.

Types of digital evidence

Unified Audit Log Records
Microsoft 365 audit entries with the user, operation, workload, object, client IP address and time for actions such as file access, sharing, mailbox rule creation and Teams message events, searchable in Microsoft Purview.
Workspace Log Events
Google Workspace admin, Drive, Gmail, login, Meet and device log events in the Admin console, each with actor, action, target and IP address.
Sign-In and Identity Records
Entra ID and Google login records with device, location estimate, authentication method and policy outcome, and the OAuth consents and application grants made on the account.
File Activity and Version History
SharePoint, OneDrive and Drive records of who viewed, edited, downloaded, shared or deleted a file, together with the file's version history and its recycle bin state.
Mail and Chat Content Under Hold
Mailbox and chat content preserved by a legal hold or a Vault retention rule and exported through eDiscovery or Vault, including items the user deleted after the hold started.
Collaboration Platform Exports
Slack workspace exports and Enterprise Grid discovery exports, Teams chat exports and meeting attendance reports.
Business Application Audit Trails
CRM field history and login history, ERP change documents and security audit logs, service desk ticket histories and HR system access logs.
Administrator Actions
Records of role assignments, policy changes, audit setting changes and export operations, including those made by the investigation itself.

Devices and data sources

Microsoft 365 tenants through Microsoft Purview audit, eDiscovery and the Exchange admin tools
Google Workspace domains through the Admin console log events and Google Vault
Microsoft Entra ID and Google identity services for sign-in and application consent records
Slack workspaces and Enterprise Grid organisations through exports and audit logs
Zoom, Webex and other meeting platforms through their usage and participant reports
Salesforce, SAP, Oracle and other business applications through their own audit and event logs
Endpoints with the desktop clients for these services, whose local caches and sync databases mirror cloud activity
Third-party applications connected through OAuth or API keys, which act on the tenant under their own identities

How an examination runs

The order matters. Each step protects the one after it.

01
Authorisation and Scope
Obtain written authorisation from the organisation that owns the tenant, name the custodians, services and date range and record the policy or legal basis. Involve HR and legal where staff are involved.
02
Preserve Before Searching
Place legal holds on the custodians' mailboxes, drives and chats, or set Vault holds, before any search or export. Turn on any audit features that are off and note the date they started.
03
Collect Audit Logs
Export the audit records for the custodians and period from the platform's search, in the native format with the original event identifiers, and hash the export. Note the retention limit of each log and where the period extends beyond it.
04
Collect Content Through the Platform's Tools
Use eDiscovery, Vault or the platform's export to collect mail, files and chats with their metadata, rather than copying from a user's client. Record every export's parameters and any size or item limits applied.
05
Add Identity and Endpoint Context
Export sign-in records and application consents for the same accounts, and where a device is relevant, collect its cloud client logs and sync databases.
06
Build the Timeline
Normalise everything to UTC, since most platform logs are already in it, tie events by user, session and object identifiers and separate human actions from service and automated activity.
07
Report With Limits Stated
State which logs existed and for how long, which actions the platform does not record, where attribution rests on the platform's own records and what the examination deliberately did not touch.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Unified Audit Log: The single searchable record of user and administrator operations across Microsoft 365 services, searched through Microsoft Purview or the Search-UnifiedAuditLog cmdlet.
Log Events: Google Workspace's term for the per-service audit records in the Admin console, such as admin, Drive, Gmail and login log events.
Legal Hold and Vault Hold: Settings that preserve a custodian's content against deletion while a matter is open. They act from the time they are set and do not restore what was already gone.
eDiscovery: The Microsoft 365 workflow for holding, searching and exporting content for legal matters. Google Vault performs the equivalent role in Workspace.
Custodian: A person whose accounts and data are within the scope of a preservation or investigation.
OAuth Consent: A user's or administrator's grant of permissions to a third-party application. A malicious consent gives an attacker lasting access without a password, and the grant is recorded in the audit log.
Tenant Administrator: An account with wide rights over the platform. Administrator actions are logged, including the actions of the investigation, which must be kept apart from the activity under review.
Retention Period: The time a platform keeps audit records or content before deleting them. It varies by licence and setting and it decides how far back an examination can see.
Workspace Export: A platform's bulk export of messages and files, such as Slack's workspace export, which is the usual way to collect chat content with its metadata.

Challenges and limits

What makes it hard

Audit retention depends on the licence and configuration, and a matter that comes to light late may fall outside the window
Audit records appear with a delay, usually within hours but sometimes longer, and a search run too soon misses events
Some actions are not logged at all, or are logged with the wrong actor, such as Teams membership changes made through other admin tools being attributed to a team owner
Platform logs cannot be checked against any underlying system. They are what the provider says happened
Export tools impose item, size and row limits and may silently omit content, so completeness must be checked against the platform's counts
Third-party applications and service accounts act under identities that do not map to a person, and their activity needs separate interpretation
An investigation run with ordinary administrator accounts mixes its own actions into the logs it is examining

Keeping the evidence intact

Use a dedicated, documented investigation account with the least rights needed, so that the examination's actions are distinct in the audit log
Set holds before searching, and record the time each hold took effect
Export logs and content with native metadata and original identifiers, hash the exports and keep the platform's own export reports with them
Record the audit retention setting and licence level of the tenant at the time of collection
Keep a log of every search, export and setting change made during the investigation

Standards and legal considerations

ISO/IEC 27043:2015
Incident investigation principles and processes, including readiness. For platforms, readiness means audit settings, retention and holds decided before an incident.
Read the guide
CERT-In Directions 2022
Covered Indian organisations must keep logs for 180 days, and the six-hour reporting duty applies to incidents in cloud-hosted services as much as on-premises ones.
Read the guide
Digital Personal Data Protection Act, 2023
Employee and customer data in these platforms is personal data. Investigations need a lawful purpose and must not spread beyond it.
Read the guide
GDPR
For organisations with staff or customers in the European Union, the General Data Protection Regulation limits monitoring and investigation of personal data and requires proportionality.
Read the guide
Digital Evidence Lifecycle
Preservation, collection, analysis and presentation as they apply when the evidence is an export rather than a seized device.
Read the guide

In practice

A Shared Link Before Leaving
An engineer resigns. The organisation authorises a scoped review of the engineer's OneDrive for the previous sixty days. The unified audit log shows a folder of design files shared with an external address through an anyone-with-the-link setting ten days before the resignation, followed by downloads from an address outside the company. The report lists the files, the sharing event and the downloads, and notes that the audit retention covered the whole period.
Consent Granted to a Rogue Application
After a phishing wave, sign-in records show successful logins for several accounts from an unfamiliar address. The audit log shows that each account granted mail-reading permissions to the same third-party application within minutes of the login. The examiner reports the consents as the persistence mechanism and the revocation times as the end of the attacker's access.
A Chat Deleted After the Complaint
A harassment complaint names messages in a Slack channel that have since been deleted. The workspace was placed under a legal hold on the day of the complaint. The export shows the messages with their deletion timestamps and the deleting user, because the hold preserved them. The examiner reports the content, the deletions and the fact that messages deleted before the hold could not be recovered.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.IntermediateCloud / Network

NetworkNetwork & Cloud ForensicsVirtual Machine / Hypervisor ForensicsExamine VMDK, VHDX and QCOW2 disks, snapshots, ESXi logs and VM memory files.AdvancedCloud / Network

MalwareIncident Response & Malware AnalysisRansomware & Threat ResponseHandle a ransomware attack from first call to recovery, reporting and lessons learnt.IntermediateMalware Analyst

LegalFoundation & Legal CoursesLegal & Court ProceduresIndian law on electronic evidence: BSA Section 63, BNSS search and seizure and the IT Act.BeginnerDCFA

Careers that use it

Questions people ask

Can the organisation examine an employee's mailbox and chats?

It can examine data in its own tenant under its own policies and a lawful purpose, with a scope that fits the matter. Staff privacy under the Digital Personal Data Protection Act, 2023 and any applicable foreign law shapes what is proportionate. Personal accounts outside the tenant are not covered by the organisation's authority.

How far back can audit logs go?

It depends on the platform, the licence and the settings. Microsoft 365 keeps unified audit records for 180 days by default and longer with premium auditing and retention policies. Other platforms have their own limits. The examiner records the limit and reports where the period of interest exceeds it.

Are platform audit logs enough on their own?

They are strong business records but they are generated by the provider and cannot be independently checked. Where it matters, the examiner corroborates them with endpoint evidence, network logs and the content itself.

What if auditing was turned off?

Then the period has no record on that platform. The examiner turns it on, documents the date and looks for other sources such as endpoint caches, mail flow logs and the other parties to a conversation.