Business Forensics
Business Forensics and Email Compromise Review
Business disputes often involve devices, cloud accounts, email records, shared drives, access logs, and employee activity. The work should answer the business question without exposing more data than necessary.
Controlled review
Internal investigations should not become uncontrolled data hunts.
A business may need to know whether files were accessed, copied, transferred, deleted, emailed, synced to a personal account, or taken through removable media. At the same time, the review may involve employee privacy concerns, privileged communications, confidential business records, and active operational systems.
Forensic review is strongest when counsel and leadership define the question, preserve the relevant systems, and keep collection proportional to the issue being examined.
Business matters reviewed
- Departing employee activity
- Suspected file transfer
- External storage use
- Cloud sync and personal storage
- Account misuse or suspicious access
- Business email compromise and mailbox review
- Internal investigations and business disputes
System correlation
The same activity may leave traces across several business systems.
One source rarely carries the whole answer. A document transfer question may require review of the employee workstation, cloud sync records, email logs, external storage artifacts, file metadata, access records, and account activity.
Endpoint
Workstation
File activity, USB records, program use, downloads, local user profile.
Mailbox
Mailbox activity, attachments, forwarding, message trace, deleted items.
Cloud
Sync & storage
Sync history, shared folders, account activity, version records, deleted files.
Access
Permissions
Logins, permissions, audit logs, account changes, administrative events.
Mobile
Device
Messages, app data, account access, photographs, files, cloud account ties.
Email compromise
Business email compromise is a mailbox timeline problem.
Payment fraud, vendor impersonation, and suspicious email activity require a review of account events, message movement, mailbox settings, and the sequence that led to the disputed communication. A spoofed sender, a compromised mailbox, a compromised vendor, and a lookalike domain can look alike in an inbox but leave very different records.
Some mailbox records are available only for a limited period or depend on the account license, logging configuration, and administrative permissions. That does not end the analysis. It means conclusions are grounded in the records that remain and in the limits of what the provider retained.
Questions often reviewed
- Was the mailbox accessed by an unauthorized person?
- Were forwarding rules or inbox rules created?
- Were messages deleted, moved, or hidden?
- Was the fraudulent instruction sent from a real account?
- Do headers and trace records support the claimed path?
- Were connected apps or recovery settings changed?
Practical questions
Business forensic work should answer a defined operational problem.
Was data accessed, copied, or transferred?
File paths, timestamps, USB records, cloud sync records, email attachments, and application artifacts may need to be compared.
Was an account compromised?
Sign in logs, mailbox settings, authentication records, recovery changes, and security alerts may support or limit that conclusion.
Did a departing employee use outside storage?
External media history, cloud folders, personal email, downloads, archives, and recent files can be examined when preserved.
Do the records support the allegation?
The review should distinguish access from copying, copying from transfer, transfer from disclosure, and suspicion from supportable fact.
Business investigation consultation
Need a controlled review of business systems or employee activity?
Rune Forensics can assist with internal investigations, business email compromise, account compromise questions, cloud and email review, departing employee matters, file movement, and business disputes.
Request Consultation