The cloud keeps a diary. We know how to read it.

What the audit trail can prove

Cloud platforms record sign-ins with location and device detail, mailbox operations, forwarding and inbox rules, file access, sharing events, downloads and synchronisation. Read together, these records establish whether an account was compromised, what an intruder or insider touched, and precisely which content left the organisation. The evidence is strongest when preserved early: several key logs age out on fixed schedules, and delay converts certainty into inference.

We investigate with proper administrative authority, extract and preserve the relevant records, and reconstruct the sequence in plain English, from first suspicious sign-in to the last file that moved.

Instructions we commonly take

• Business email compromise and invoice-fraud investigations.
• Establishing what a departing employee accessed, downloaded or shared.
• Scoping a suspected breach for insurers, boards and regulators.
• SharePoint, OneDrive and Dropbox access and exfiltration analysis.

Frequently asked

How long are Microsoft 365 audit logs retained?

It depends on licensing and configuration; some records are retained for months, others far less. Because several logs age out on fixed schedules, early preservation matters more in cloud investigations than almost anywhere else.

Can you tell exactly which emails or files left?

Frequently, yes. Mail flow records, sharing events and download logs, correlated with sign-in data, can identify the specific items taken and the account and network that took them.