- Nationwide Digital Forensic & Cyber Investigation Services
Microsoft 365 holds the mail, files, and chat records that define most business data exposure. Whether an investigation can say what an intruder actually read depends almost entirely on audit settings, licensing, and retention configured long before the incident. This page explains what those records contain and how examiners use them.
| Question | One line answer |
|---|---|
| Can you prove which emails were read? | Yes when advanced mailbox auditing was licensed and enabled at the time. |
| How far back does the audit log go? | Commonly about 180 days at baseline licensing, longer with premium tiers or audit retention policies. |
| Does message trace last as long? | No. Detailed trace data is much shorter lived and should be exported immediately. |
| Can deleted email be recovered? | Often, through recoverable items and holds, if a hold is applied before purge windows elapse. |
| Are file downloads recorded? | Yes. SharePoint and OneDrive record file access, download, and sharing events. |
| Does eDiscovery replace forensics? | No. It collects content; forensic analysis explains access, actor, and sequence. |
| Term | What it means |
|---|---|
| Unified audit log | The tenant wide record of user and administrative activity across Microsoft 365 workloads. |
| MailItemsAccessed | A mailbox audit action recording that specific messages were accessed by a sync or bind operation. |
| Message trace | Delivery records for messages entering and leaving the tenant, used for forwarding and outbound fraud analysis. |
| Recoverable items | The hidden mailbox area holding deleted content, retention of which is extended by a hold. |
| Litigation hold | A setting that preserves mailbox content against deletion and purge for the duration of the hold. |
| Audit retention policy | Configuration extending how long specific audit record types are kept beyond the default window. |
Microsoft 365 is not a single log. It is a set of workload specific record streams that surface through a common audit interface, each with its own coverage and licensing dependency.
| Source | Answers | Practical note |
|---|---|---|
| Unified audit log | What operations occurred, by which account, when | Baseline retention commonly about 180 days, extended by license or audit retention policy |
| Mailbox audit (MailItemsAccessed) | Which specific messages a session accessed | Requires appropriate licensing; the highest value record for exposure scoping |
| Inbox rules and forwarding | Attacker hiding and exfiltration mechanisms | Capture the rule definition before removing it |
| Message trace | What was sent and where it was delivered | Detailed data ages out fast; export at the outset |
| SharePoint and OneDrive activity | File views, downloads, sharing, and deletion | Central to exfiltration questions in file heavy environments |
| Teams activity | Message and meeting events, membership changes | Increasingly relevant as business records move into chat |
| Entra ID sign in logs | The authentication behind each session | Shorter retention than the audit log, so export separately |
Two organizations can suffer identical intrusions and reach different conclusions purely because one had advanced auditing and the other did not. Examiners must document which record types were available so that readers understand the basis and the boundaries of the findings.
Mailbox compromise is the most common Microsoft 365 incident. The analytical goal is to bound each unauthorized session precisely and then determine what that session touched.
Bound the intrusion. Use sign in logs to establish first and last unauthorized authentication, including non interactive sign ins that indicate token replay.
Identify persistence. Pull audit records for authentication method registration, inbox rule creation, forwarding, delegation, and application consent.
Determine access. Query MailItemsAccessed for the intrusion window to identify the specific items opened or synchronized.
Trace outbound activity. Use message trace to identify fraudulent messages sent from the account and their recipients.
Assess reach. Check whether the account was used to access files, Teams content, or other mailboxes through delegation.
Scope exposure. Review the accessed message set for regulated data so counsel can evaluate notification duties on facts.
Where the record shows a sync operation rather than individual binds, the correct interpretation is that the entire folder should be treated as accessed. That distinction has direct consequences for the size of a notification population and should be explained explicitly in the report.
We preserve tenant evidence and scope exposure on the records, so notification decisions rest on facts.
As business records moved into cloud file storage and chat, the exfiltration question moved with them. A departing employee or an intruder with a valid session can move very large volumes without touching a single external tool.
Activity records showing sustained download volume from a single session, frequently just before a resignation or after a compromise.
Anonymous or external sharing links created on sensitive libraries, which persist after the account is disabled.
Registration of a new sync client that pulls entire libraries to an unmanaged device.
Guest accounts added to Teams or sites, providing quiet ongoing access to internal content.
Records showing content altered or removed, which matters in insider and spoliation disputes.
Whether deleted content is recoverable depends on holds and retention policies in force at the time.
These records are also the reason preservation matters even when nothing appears wrong. A hold placed on discovery of an issue protects content prospectively, but it cannot recreate audit records that already rolled off.
Every Microsoft 365 investigation ends with the same observation: the useful findings came from settings enabled before anyone suspected a problem. These are the ones that matter most.
Baseline retention is measured in months, varies by record type and license, and premium record types may not have been captured at all.
Audit configuration only affects future events. There is no retroactive capture.
eDiscovery finds content. Forensics establishes who accessed it, when, from where, and under what session.
The rule definition is evidence and should be exported before removal, and the rule is rarely the only persistence.
| Record | Establishes | Licensing sensitivity | Typical urgency to export |
|---|---|---|---|
| MailItemsAccessed | Specific messages accessed | High, requires advanced auditing | High |
| Inbox rule events | Attacker persistence and concealment | Low | High |
| Message trace | Outbound fraud and forwarding | Low | Very high, short retention |
| SharePoint activity | File access, download, and sharing | Low to moderate | Moderate |
| Sign in logs | Session bounding and source | Moderate | Very high, short retention |
| Admin audit events | Configuration and privilege change | Low | Moderate |
We investigate Microsoft 365 tenants for businesses, outside counsel, and cyber insurance carriers. Our examiners preserve the short lived records first, scope exposure on the evidence rather than on assumption, and produce reports written for the people who have to make notification and claim decisions.
Immediate export of audit, sign in, mailbox rule, and message trace data with documented methodology.
Session bounded reconstruction of unauthorized access with message level exposure findings where records allow.
Review of SharePoint, OneDrive, and Teams activity for bulk download, sharing abuse, and sync based collection.
Analysis of file activity and sharing in the period before a resignation or termination.
Verification that licensing, auditing, and retention will support an investigation before you need one.
Findings suitable for regulators, carriers, and litigation, supported by court qualified examiners.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Baseline unified audit log retention commonly runs about 180 days, with longer windows available through higher license tiers and audit retention policies applied to specific record types. Sign in logs and detailed message trace have significantly shorter windows and should be exported first.
Where advanced mailbox auditing was licensed and enabled, MailItemsAccessed records identify the specific items a session accessed. Where the record shows a folder sync rather than individual access, the whole folder should be treated as accessed, which is an important distinction for notification scope.
eDiscovery collects and reviews content for legal proceedings. Forensic analysis explains access: which account, from which address and device, during which session, and in what sequence. Investigations usually need both, but one is not a substitute for the other.
Frequently yes. Deleted items move to the recoverable items area, and applying a litigation hold preserves that content against purge. The sooner the hold is applied, the better the odds, because purge windows continue to run until it is in place.
Yes. File access, download, sharing link creation, sync client registration, and deletion are recorded in the unified audit log. These records are central to both intruder exfiltration analysis and departing employee investigations.
Revoke sessions and refresh tokens, apply holds to affected mailboxes, export sign in logs and message trace immediately, capture inbox rules and consented applications before removing them, and engage an examiner before remediation eliminates the records needed to scope exposure.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder