- Nationwide Digital Forensic & Cyber Investigation Services
Google Workspace centralizes email, documents, and identity for many small and mid sized businesses, which makes its audit trail the primary evidence source when an account or a whole domain is compromised. This page explains what the admin console records, how long it stays available, and where an investigation needs Vault or OAuth analysis to close the gaps.
| Question | One line answer |
|---|---|
| How long are Workspace audit logs kept? | Retention varies by event type and license, commonly around six months, though some categories are shorter. |
| Can Workspace logs show a file was downloaded? | Drive audit events show view, edit, download, and sharing actions when audit logging is enabled for that event type. |
| What is Google Vault used for in an investigation? | Vault applies litigation holds and exports mail, Drive, and chat content that might otherwise be deleted by users or retention rules. |
| Can an attacker read email without a password reset? | Yes, most often through a malicious OAuth application granted access by the user, which does not require the account password. |
| Does Takeout replace a forensic export? | No, Takeout is a self service user export with no admin authentication metadata and no chain of custody controls. |
| Who should pull the logs? | An independent examiner working with the Workspace super administrator, so scope and methodology are documented and defensible. |
| Term | What it means |
|---|---|
| Admin console audit log | The centralized record of login, admin, Drive, token, and group activity across a Workspace domain, viewable and exportable by a super administrator. |
| Login audit log | Records of successful and failed sign in attempts, including IP address, device, and the authentication method used. |
| Drive audit log | Records of file view, edit, download, share, and permission change events for content stored in Drive. |
| Token audit log | Records of OAuth application authorizations and revocations, showing which third party apps were granted access to a user account. |
| Google Vault | The Workspace retention and eDiscovery product used to place litigation holds and export mail, Drive, and chat content for legal matters. |
| OAuth token abuse | Use of a maliciously authorized or stolen third party application token to access account data without needing the account password. |
A Workspace super administrator has access to several distinct audit log categories, and an investigation typically needs more than one to build a complete picture of a compromise.
Retention determines how far back an event can be found at all. Lag determines how quickly a recent event becomes visible. Both matter in an active incident: some Workspace event types can take hours to populate, which means an examiner working the first day of a compromise may need to re-query the console after that lag window has passed rather than concluding an event did not happen because it was not yet visible.
Google Vault is Workspace built in retention and eDiscovery tool, and it plays two distinct roles in an investigation. First, an immediate litigation hold on the affected accounts prevents user side deletion of mail, Drive files, or chat messages while the review is underway. Second, Vault exports produce mail and Drive content in formats suitable for review platforms, with export activity itself logged.
| Vault capability | What it does | What it does not do |
|---|---|---|
| Litigation hold | Preserves content against user deletion and standard retention rules | Does not by itself capture metadata about who accessed a file before the hold was applied |
| Mail export | Produces account mail in standard formats for review | Requires the export to be requested for the correct date range and accounts, or evidence is missed |
| Drive export | Captures file versions and some sharing metadata | Does not always preserve full audit trail context for older sharing changes |
| Chat and Meet export | Captures chat spaces and meeting metadata where retention applies | Coverage depends on the specific Chat and Meet product configuration in use |
Every hour without a litigation hold and a documented log export is an hour of exposure to deletion and rolloff. We can scope and begin preservation the same day.
One of the most consequential and least understood Workspace attack paths does not involve stealing a password at all. A user is phished or socially engineered into authorizing a malicious third party application, and that application receives an OAuth token with scopes to read mail, list files, or access Drive content. The token can persist and be used long after the phishing message is gone, and a password reset alone does not revoke it.
A fake application impersonating a familiar service requests broad Gmail or Drive scopes and the user clicks allow without reading the permission screen.
The token remains valid until explicitly revoked in the Workspace admin console or by the user, independent of password changes or even multi factor status.
API based access through a valid token frequently does not trigger the same alerting as an interactive login, leaving fewer visible signals.
The token audit log is often the only reliable record of which application was authorized, when, and with what scopes, making it essential evidence.
Investigating a suspected token compromise means reviewing the token audit log for every account in scope, checking application names and publisher verification status, and cross referencing authorization timestamps against phishing email delivery and click events from the mail security platform. Revocation should happen for any application that cannot be positively verified as legitimate business software.
Small business Workspace incidents commonly begin as a single compromised account but the real question for notification and remediation purposes is always whether the compromise reached further, through shared drives, delegated mailbox access, or an administrator account.
Confirm which accounts show anomalous login activity, unfamiliar IP ranges, or new device registrations in the login audit log.
Check whether any compromised account held super administrator or delegated admin privileges, which would expand the blast radius to domain wide settings.
Review the Drive audit log for the compromised accounts for external sharing changes and bulk download activity, which distinguishes read access from data exfiltration.
Check the token audit log across the domain for the same malicious application appearing on other accounts, which indicates a phishing campaign rather than an isolated compromise.
Document what could not be determined due to retention rolloff or missing audit log categories, since Workspace license tier affects which events are even captured.
It does not revoke OAuth tokens or active sessions on their own. Both need to be explicitly revoked in the admin console.
Takeout is a self service export with no chain of custody or admin level metadata and it can be triggered by the compromised account itself.
Some event categories post with a delay of hours, and query results should be treated as provisional during the first day of response.
Any Workspace domain with Vault licensing available can and should apply a hold the moment litigation or regulatory exposure is possible.
We are engaged by businesses, outside counsel, and cyber insurance carriers to independently investigate Google Workspace compromises, from a single phished mailbox to domain wide administrator abuse. Our examiners coordinate directly with Workspace super administrators to apply holds, pull logs across every relevant category, and produce findings that hold up under scrutiny.
Same day litigation hold and export of login, admin, Drive, and token audit logs before rolloff and before remediation actions overwrite evidence.
Analysis of the token audit log across the domain to identify malicious application authorizations and their scope.
A defensible finding on whether a compromise was limited to one account or reached shared drives, delegated mailboxes, or admin settings.
Correlation of Drive download and sharing events with login activity to support or refute a claim that data left the organization.
Evidence based input for counsel on whether the facts support a reportable event under applicable breach notification law.
Court qualified examiners able to explain Workspace audit logging, Vault, and OAuth mechanics under direct and cross examination.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Retention varies by event category and Workspace edition, but many core audit log types are commonly available for around six months. Some categories are shorter, and higher license tiers unlock additional event types and longer windows, so confirming the applicable retention for the specific domain is an early investigative step.
Yes, when Drive audit logging is enabled for that event type, download, view, and sharing actions appear in the Drive audit log tied to the acting account and timestamp. This is a key source for distinguishing mere access from likely exfiltration.
Not fully. A password reset does not revoke previously granted OAuth application tokens or necessarily terminate every active session. Both need to be explicitly revoked in the admin console as part of a complete remediation.
Takeout is designed as a self service personal data export and lacks admin level audit metadata, chain of custody documentation, and independence, since it can be triggered by the account under investigation. It has narrow uses but should not substitute for admin console log export and Vault.
Vault applies litigation holds that prevent user side deletion of mail, Drive, and chat content, and it produces formatted exports for legal review. The admin console shows activity logs, while Vault preserves and exports the underlying content itself.
Often yes, by combining login audit review across all accounts, admin audit review for privilege or setting changes, and token audit review for a shared malicious application. Confidence depends on which audit categories were enabled and how quickly logs were preserved.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder