Work across the places mail is stored.
Email can supply correspondence, timestamps, attachments, and routing records relevant to a matter. The recovery approach depends on the source, retention settings, and available archives or logs.
Our work covers Microsoft Exchange, Microsoft 365, Google Workspace and Gmail with Google Vault, legacy SMTP and IMAP servers, local archives including PST, OST, and MBOX, proprietary mail formats, and mobile mail clients.
Recover the message and assess its context.
Deleted messages
We examine available mail stores, archives, and server records. Retention and archive settings may preserve messages after a user deletes them; recoverability depends on what remains available.
Authentication and timestamps
Headers and server logs are analyzed for send-and-receive history, signs of forgery or alteration, and timestamp interpretation across timezones and clock differences.
Attachments
Binary attachments are extracted with hash verification. Where an attachment itself is disputed, it can be referred into the appropriate forensic examination workflow.
Prepare correspondence for counsel's review.
Recovered mail can be loaded into our in-house iConect review environment or exported in the format and load files required by your review platform.
Preserved metadata, attachments, and acquisition documentation accompany the work so the recovery and examination can be explained.
Scoping the engagement.
Describe the mail platform, number of custodians, relevant date range, and known retention or archive settings. Include what access and prior collections are available.