Email & Cloud Exfiltration Forensics

Data that leaves by email or cloud makes two records — one on the machine, one in the service — and a sound investigation reads both. Mailbox rules, attachment history and sign-in patterns from the tenant; browser and sync artefacts from the device; correlated into a single dated account of what went where, for York employers and their advisers.

Method before speed. The free assessment and a written scope come first; forensic fees are settled in full before any examination starts. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.

// patterns that prompt this examination

What email and cloud exfiltration looks like

Individually explainable, collectively a pattern — these are the observations that start cases.

Large attachments sent to a personal address over recent weeks
An auto-forwarding rule found on a mailbox after someone left
Sign-ins to company accounts at hours nobody was working
A personal Dropbox, OneDrive or Google Drive on a company laptop
Bulk downloads from SharePoint or a shared drive before an exit
A leaver's mailbox deleted before anyone thought to check it

Mailbox behaviour that marks an exit

A mailbox being used to move data out behaves in recognisable ways. Attachment sizes climb, and the recipients narrow to one personal address; a forwarding rule appears, quietly copying selected mail outward; the mailbox search history shows hunting — customer names, project terms, price lists — rather than day-to-day work; and access times drift to evenings and weekends. Each of these is recorded by the mail platform itself, and each is retrieved and dated in the examination.

Personal cloud on company hardware

The device tells the other half. Browser artefacts record sign-ups and sign-ins to personal Dropbox, OneDrive and Google Drive accounts from the company machine; sync-client logs and folder structures show which directories were being mirrored upward and when; and the residue of uploads — cached pages, transfer confirmations, recent-file lists — survives on the image long after the browsing history is cleared. A personal cloud account appearing on company hardware in a final month is rarely idle.

The audit trail your tenant already holds

Microsoft 365 and Google Workspace keep their own evidence, and it is frequently decisive. Purview audit logs and eDiscovery exports record message movements, sharing events and downloads; Google Vault preserves mail and files under hold; SharePoint and OneDrive logs list every share and bulk download with account and timestamp; Dropbox holds version histories and recoverable deleted files. Deleted mailboxes can often be restored from retention or backup — for a limited window. That window is the reason to call early.

Two records, one account

The finding that persuades is the correlated one: the tenant logs a 2.1 GB download at 21:14, the device shows the same files entering a personal sync folder at 21:16, and the browser history closes the loop. We assemble device and service evidence into one sequence, flag where the two disagree, and preserve everything — mailbox exports, audit extracts, the machine's image — under hash before any account is suspended or licence reclaimed.

The wider method is at the forensic recovery hub. Server-side and credential evidence continues on insider threat forensics, the employer casework on employee data theft, and preservation practice on legal hold & chain of custody. Fees are on our prices page.

// what the investigation returns

Findings across mailbox, cloud and device

Service records and machine artefacts, cross-checked and presented as one timeline.

Attachment analysis

What went to personal addresses, when, and at what size.

Rule history

Forwarding and deletion rules, with creation dates and scope.

Access patterns

Sign-in times, locations and the out-of-hours clusters that stand out.

Personal-cloud traces

Sign-ups, sync folders and upload residue on the company machine.

Tenant audit extracts

Sharing, download and export events from M365 and Workspace logs.

Recovered mail

Deleted messages and mailboxes restored from retention and backup.

// fees and footing

Forensic fees, and the lawful basis we require

What forensic work costs

The free diagnostic that opens every case is completed within 2 working days of arrival; forensic casework itself is not a no fix, no fee service. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Multi-account and tenant-wide scopes are quoted in writing after the free assessment. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.

Who we can act for

Email and cloud casework proceeds on company tenancies and company devices, or under a solicitor's instruction. Instructions are accepted on three footings only: equipment the company itself owns; the instruction of a solicitor, insurer or court; or devices that are genuinely the client's own — including jointly owned machines in matrimonial matters. We do not hack, we do not intercept live communications, and we do not examine a device the instructing client has no right to examine.

// getting your device to us

Sending it in — easier than you'd think

Cloud evidence is preserved by export as much as by post. Call 0800 689 0668 to walk through what gets captured remotely and what travels; devices are received at our Leeds location with custody recorded from signature.

Is the drive still inside a computer, laptop, MacBook, iMac, CCTV / DVR or server? Take the hard drive or SSD out first and post the bare drive on its own — removing drives from machines isn't a service we offer. Storage that's soldered to a motherboard (Apple Silicon Macs, certain slim laptops) is the one thing we can't work on: if it doesn't come out, it can't come in.

  • Bubble wrap and a sturdy box or padded envelope will do nicely — cables, caddies and power bricks can stay at home.
  • Print off the booking-in & shipping form (PDF), add your name, number and a line or two on what happened, and tuck it in the parcel.
  • Royal Mail Special Delivery keeps it tracked and insured the whole way; your own courier does the same job if you'd sooner book one. There's no collection service at this end.
  • Happier handing it over in person? Reception at the address here takes drop-offs, Mon–Fri 9:00am–5:30pm.
// where your device is headed

Leeds Data Recovery

17th Floor, The Pinnacle
Albion Street
Leeds, LS1 5AA

↓ Print the booking-in & shipping form (PDF)

Address the parcel for the attention of Leeds Data Recovery — about 40 minutes from York via the A64 and A1(M), or next working day by tracked post. You'll hear from us the moment it's booked onto the bench.

Not certain what to pack? Ring 0800 689 0668 first, or run the free online diagnostic.

// email & cloud — answered before instruction

What IT managers ask us

Often, if the call comes soon enough. Deleted mailboxes commonly survive in retention for a recoverable window, and backups or litigation holds extend that further. The window is finite, so preservation should start the day the question is asked.
The rule's configuration shows what it selected, and the tenant's message-trace and audit records show what moved while logs remain. Where the log window has lapsed, the receiving pattern on the device often fills the gap — and we report exactly which parts rest on which source.
No — a personal account is outside an employer's reach and outside ours. What we examine is the company's side of every exchange: the tenant's logs, the device's artefacts, and material a court later requires to be disclosed. That side is usually enough.
Secure it, but preserve first: export the mailbox, capture the audit logs and image the device before licences are reclaimed or the account is purged. Suspension done in the wrong order has destroyed more email evidence than any leaver — we will talk your IT team through the sequence on the phone.

The tenant remembers. For a while.

Retention windows close on their own schedule — ring the freephone before they do.