±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Jobs
±Latest Webinars
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Office 365 forensic
Office 365 forensic
Posted: Sun Aug 05, 2018 11:12 am
Dear all,
I am interested in improving my skills.
If I need to acquire a company that use store data on onedrive use share point etc which software is available?
Thanks
I am interested in improving my skills.
If I need to acquire a company that use store data on onedrive use share point etc which software is available?
Thanks
-
giandega - Senior Member
Re: Office 365 forensic
Posted: Mon Aug 06, 2018 2:03 am
The most straightforward thing to do would be to speak to an O365 Admin at the company in question and get them to produce the data for you from the Security and Compliance Centre from within O365.
The built in e-Discovery tool is extremely powerful across large scale enterprise.
From within the Security and Compliance Centre your Admins should have access to the UAL (unified audit log) to produce any log files you require to prove file access, folder access, times and dates, deletions etc.
Check out this link to Microsoft's support pages where you can find loads of good information:
Microsoft O365 Support - Manage e-Discovery Cases
The built in e-Discovery tool is extremely powerful across large scale enterprise.
From within the Security and Compliance Centre your Admins should have access to the UAL (unified audit log) to produce any log files you require to prove file access, folder access, times and dates, deletions etc.
Check out this link to Microsoft's support pages where you can find loads of good information:
Microsoft O365 Support - Manage e-Discovery Cases
-
hectic_forensics - Member
-
giandega - Senior Member
-
hectic_forensics - Member
Re: Office 365 forensic
Posted: Fri Aug 10, 2018 11:02 am
My former colleague Adam Harrison has published some decent research into this very area:
blog.1234n6.com/2018/0...nt_12.html
blog.1234n6.com/2018/0...nt_12.html
-
redcat - Senior Member