Nothing on these pages is more perishable than tenancy audit data. It is written automatically, it is comprehensive, it is sitting there now, and it expires on a schedule set by a licence nobody chose with an investigation in mind. That single fact governs the order of this page: arrange the export first, work out what you want to ask afterwards. Everything else — the forwarding rules, the sync client's local diary, the browser residue — waits perfectly well. The logs do not.
◇ Most of the exporting is yours. The reading is ours. £800 + VAT for the examination and report, £400 + VAT for a verified image with deleted material extracted and no findings — the recorder-drive price, not a sixth tier. Free diagnostic, scope in writing. Investigations sit outside no fix, no fee. Ordinary bands.
Microsoft 365 and Google Workspace record a great deal more than most administrators realise, and retrieving it requires nothing exotic — your own IT people can run it against a written list of what is wanted and for which dates. Sign-ins with times, addresses and device details. Activity at the level of individual files: opened, downloaded, shared, moved, removed. Sharing links, including anonymous ones. Every mailbox rule with the date it was created. Administrative actions, such as one account being granted rights over somebody else's mailbox. Access is not the difficulty. Retention is. Some of it survives ninety days, some considerably less, and how much depends on a licence tier chosen years ago for reasons unconnected to any of this. Waiting to see how the situation develops is, in this one respect, the most expensive decision available.
Mail is the oldest route out and it is still the busiest, and the patterns are tediously consistent. Attachments to a private address in ones and twos over several weeks, so that no single message would ever draw attention. A forwarding rule created quietly, frequently paired with a second rule that deletes the forwarded copy so that sent items goes on looking innocent. A burst of large sends in the last few days. Then a purge. What makes this workable is how little of it the sender actually controls: message headers, transport logging, mailbox audit entries and the tenancy's own retention all sit outside the folders anybody can clear out, and a rule that deletes its own evidence still has a creation date attached to it.
This is the part clients do not expect, and it is why the endpoint gets captured even when the argument appears to be entirely about a cloud account. OneDrive, Dropbox, Google Drive and Box each keep local databases on the machine recording which account is signed in, which folders are being mirrored, what was uploaded and when, and what was taken away afterwards. A personal account authenticated alongside the corporate one is among the most productive single findings in this practice, because it generally means a mirrored folder of company documents somewhere on the disk with an upload history attached to it. Browser artefacts complete the picture: transfer sites, webmail sessions, download history, and the sign-in pages visited immediately before each of them.
Take an evening on which the tenancy shows a document library downloaded at 20:14. Standing alone that is somebody working late, and it will be explained as exactly that. Now put the laptop beside it: the account signed in, a browser session open, an archive written into the downloads folder, and twenty minutes later a personal sync client pushing up a folder of comparable size. The second record does not repeat the first — it narrows what the first can plausibly mean, which is what corroboration is for. Where the two ends disagree, the disagreement is printed with both dates rather than resolved in favour of whoever commissioned the report.
A work mailbox is examined against the question in dispute, over defined dates and defined categories, and the reasons for that scope are written down before anything is read. That is partly a data protection obligation and partly self-interest: an examination that turned into a general read of somebody's correspondence is an examination the other side will spend the hearing attacking instead of answering. The hard boundaries sit outside it altogether. A private Gmail account or somebody's own Dropbox needs their consent or an order aimed at them or the provider. Live traffic is not intercepted. What remains inside the line is everything your own systems and your own hardware recorded about the transfer, and that is nearly always sufficient.
The handling underneath all of this is on the forensic practice hub. The endpoint half is captured at workstation deep imaging, credentials and standing access carry on at insider threat forensics, and where proceedings are in prospect the preservation duty begins at legal hold and chain of custody.
Every one of these has a dull explanation available on its own. Three of them inside the same month is a pattern, and a pattern is what an examination is for.
Every entry carries its own date and its own source, and the two sources stay separate in the report so they can be compared rather than blended into one another.
Each attachment that reached a private mailbox, with its size and the date it went.
When each forwarding or deleting rule was made, and what it caught afterwards.
Times, addresses and devices, with out-of-hours clusters marked as such.
Personal accounts, mirrored folders and upload records sitting on the disk.
Share, download and export events straight out of the tenancy's own audit trail.
Messages and entire mailboxes restored from hold, retention or backup.
Rather more of this instruction happens on your own systems than on ours, and the pricing follows that. Your administrators run the exports to a written list; the fee attaches to reading them, correlating them against whatever endpoint material exists, and writing the result up. £800 + VAT covers that examination and its report. £400 + VAT covers a machine imaged, verified and stripped of its deleted material with nothing analysed, which is the figure a recorder drive already carries and not a sixth tier bolted onto the list for investigations.
Investigations are outside no fix, no fee — one of four published exclusions, with electronic and mechanical failure, chip-level work and DVR jobs — and the fee is settled at the start because the hours do not change with the answer. A single machine and a single question is what each figure assumes; a tenancy plus four laptops is measured in the free diagnostic and written down before you agree to it. The diagnostic itself costs nothing and closes two working days after an exhibit is booked in at Oxford, where the custody file opens at the same moment. Non-evidential recovery keeps its ordinary price.
Mailbox and tenancy work is done on a company's own systems with that company's authority, or on a solicitor's, insurer's or court's written instruction. The third route — hardware that genuinely belongs to the person asking — comes up here less often but applies in the same way. Nothing reaches beyond those three. A private Gmail account or somebody's own Dropbox needs their consent or an order aimed at them or at the provider, and reaching in without one would be unauthorised access under the Computer Misuse Act 1990. Live traffic is not intercepted here at all, that being reserved by the Investigatory Powers Act 2016 to bodies this is not one of. Passwords belonging to other people are not defeated, monitoring software is not supplied or recommended, and phones and tablets are not examined in any kind of matter.
The greater part of a tenancy investigation happens on your own systems, so ring 0800 689 0668 first and we will settle what has to be exported and by when. Where a laptop needs capturing as well, the drive travels to Oxford by tracked, insured post or across the counter there in office hours. Nothing is collected anywhere in this network and Coventry has no counter of its own.
As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.
↓ Print the shipping & booking-in form (PDF)
Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.
Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.
Audit logging expires on a timetable nobody in your business chose. Ring the freephone and get the export arranged while the window is still open.