From a trusted instruction to an evidence-led decision.

The changed instruction could involve a compromised mailbox, a compromised delegate, a malicious application, an external impersonation, authorised activity that has been misunderstood, or a change elsewhere in the payment workflow. These hypotheses predict different records. A familiar sender name alone does not decide between them. The enquiry should ask which account and session performed the relevant operation, which content was transmitted, and which independent records support the business decision.

Scope is built around those questions: relevant legal entities, accounts, devices, administrators, time periods and reporting recipients. For a principal or private office, access to personal correspondence is not automatically justified by access to an operational mailbox. Separate the material needed to examine the instruction from unrelated family or adviser information, and record the authority under which each source is acquired.

The acquisition plan is also an operational decision. An active compromise may require prompt containment while volatile or short-retention evidence is still being preserved. Record why an action was taken and what it could change. A new session revocation, password reset or rule deletion should be distinguishable from activity that preceded the investigation.

Technical basis: NIST SP 800-86: integrating forensic techniques into incident response ↗

A cloud export is a representation produced by a service at collection time. It is not a physical image of the provider’s infrastructure. Its record should identify the source account or tenant, collection authority, collector, time interval, query, pagination, export format, tool version and known omissions. Keep the acquired export separately from working copies, and document subsequent parsing, filtering and enrichment.

A cryptographic digest detects a difference from the bytes associated with a recorded value. It cannot demonstrate that the provider’s original event was truthful, that an export was complete, or that the reference digest itself was protected. Preservation therefore combines integrity values with controlled storage, access records, documented transfers and a reproducible handling history. Where redaction is required, the redacted document becomes a separately identified derivative rather than a silent replacement for the acquired material.

Technical basis: NIST IR 8387: digital evidence preservation considerations ↗

For this sample, the JSON and its digest are demonstrative fixtures only. In an engagement, the examiner would maintain a manifest linking each input to its derived outputs and the report references using them. Another examiner should be able to rebuild a material timeline row from the retained input and documented transformation, or identify exactly why reproduction is limited.

An event may contain the time an action occurred, the time a service ingested it and the time the examiner collected it. Those values answer different questions. Converting a displayed timestamp to UTC makes comparison easier but does not remove source clock error, event aggregation or delivery delay. Preserve the original value and timezone alongside the normalised value and any known precision limitation.

For a controlled illustration, suppose two source clocks have known uncertainty of ±90 seconds. An event displayed at 09:06:22 and another at 09:07:00 have overlapping possible intervals. Their displayed order alone does not establish which occurred first. If the uncertainty has not been measured, do not invent a numeric interval; record that ordering remains unresolved and look for a causal identifier or independent evidence.

A shared IP address can group unrelated users behind one egress point, and a subject line can be reused. Treat either as supporting context, not a unique join key. Preserve unsuccessful correlations too: a missing session match may reflect a collection gap or different identifier semantics rather than proof that the events are unrelated.

Microsoft’s MailItemsAccessed documentation distinguishes Bind access to individual messages from Sync activity. Bind records can include InternetMessageId values and combine activity within a two-minute interval. Sync records describe synchronised folder activity, and subsequent offline access is outside the cloud audit trail. The event’s access type and client context therefore change how narrowly exposure can be described.

For the synthetic E-03 row, an access reference to the payment conversation supports a specific recorded access relationship. It does not, by itself, identify a human reader or establish a complete exfiltration boundary. A real investigation would inspect the access type, available session and client fields, record aggregation and the provider’s current audit behaviour before assigning that interpretation.

Technical basis: Microsoft Purview: interpreting MailItemsAccessed records ↗

We would also separate what each collected source contributes. Message trace can support transmission context, while a retained message supplies the content actually examined. An inbox-rule record needs its recorded parameters and timing to explain its effect. Delegate permissions, application grants and identity events can test alternative routes to an operation. The absence of one expected record matters only after checking whether that event was collected, retained and within the source’s documented coverage.

The report should distinguish an observation from an inference. “The retained instruction contains a changed beneficiary” describes examined content. “The changed instruction was associated with this session” requires a defensible correlation. “This named individual caused the change” is a materially different attribution question that may need evidence outside the available digital records.

For each material conclusion, document the supporting records, contradictory evidence, collection gaps and alternative explanations that remain viable. Qualitative confidence should be tied to that reasoning. Do not attach a numeric probability merely to make the report look scientific. Where a source cannot establish the number of affected messages, provide the supported boundary and the uncertainty rather than presenting an invented exact count.

A technical peer review can challenge the joins, time assumptions and interpretation of source fields, and reproduce decisive transformations. This matters because software changes can alter the meaning of an artefact. A tool-generated label is an input to examination, not a substitute for understanding how the underlying record was produced.

Technical basis: NIST scientific foundation review of digital investigation techniques ↗

The principal needs to know what can be decided now, what must remain on hold and who owns the next step. In this scenario, independent verification fails, so the instruction remains held even if the identity of the account operator is unresolved. Conversely, a successful technical cleanup does not validate a beneficiary. The payment decision must follow the office’s authorised process and the relevant banking controls.

The restricted executive brief would identify the affected instruction, the supported account activity, the immediate controls and the unresolved questions. A separate technical annex would preserve the evidence references and reconstruction method. Distribution can be tailored to the principal, designated advisers, technical responders and counsel so that recipients receive the detail necessary for their role.

Closure criteria should connect both workstreams: documented verification of the instruction, review of the relevant access paths, recorded containment actions, an explained evidence gap register and ownership of any residual monitoring. This provides a defensible handover without treating a technical report as a decision about legal liability or a guarantee that every possible source has been recovered.