Should I preserve the mailbox as well as the individual message?¶
title: Should I preserve the mailbox as well as the individual message? subtitle: Preserve more than one message when the question extends to account activity, context or a wider pattern. slug: should-i-preserve-the-mailbox-as-well-as-the-individual-message series: email-evidence section: first-actions card_type: question_card pathway_order: 5 section_order: 4 status: draft public_safe: true video_ready: true word_count: 578 estimated_read_time_seconds: 239 audiences: - investigator - supervisor - fraud and compliance practitioner tags: - email evidence - mailbox - provider records - audit logs - proportionality sources: - title: 'Microsoft Learn: Trace an email message in Exchange Online' url: https://learn.microsoft.com/en-us/exchange/monitoring/trace-an-email-message/trace-an-email-message - title: 'Microsoft Learn: Audit log activities' url: https://learn.microsoft.com/en-us/purview/audit-log-activities - title: 'Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts' url: https://learn.microsoft.com/en-us/purview/audit-log-investigate-accounts - title: 'Google Workspace Admin Help: Troubleshoot message delivery with Email Log Search' url: https://support.google.com/a/answer/7513679?hl=en-GB
Should I preserve the mailbox as well as the individual message?¶
Preserve more than one message when the question extends to account activity, context or a wider pattern.
Script¶
Sometimes the individual email is enough.
Sometimes it is only the visible tip of an account-level event.
The right question is not, “Should I always seize or export the whole mailbox?”
It is, “What else do I need to understand that this one message can’t show me?”
An individual email may preserve the content, attachments, header and delivery information carried with that message.
It won’t normally show every related message, deleted item, draft, account login, mailbox rule, forwarding setting, delegate action or provider event.
If the issue is simply whether a particular message was received and what it said, preserving the original email may be proportionate.
If the enquiry concerns a longer conversation, repeated contact, harassment, fraud, account compromise, unauthorised forwarding, deleted messages or who had access to the account, the mailbox context may be essential.
Consider preserving more where you need to answer questions such as:
Was this part of an earlier thread?
Were other recipients contacted?
Did the recipient reply?
Was a draft created?
Was the message moved or deleted?
Did a rule automatically forward or hide it?
Was the mailbox accessed by another user or session?
Were similar messages sent from the same account?
Did the account holder report that items disappeared?
A complete mailbox export may help with some of those questions, but it is not the only option.
An organisation may be able to place a preservation hold, export a targeted date range, retain particular folders, run a message trace, preserve audit logs or search for related Message-ID values.
A focused collection may be more proportionate and easier to review than taking years of unrelated private correspondence.
The mailbox and the provider records also need to be treated separately.
A mailbox export may contain messages and folders but not every sign-in, delivery event, administrative change or audit record held by the service.
Provider-side logs may show that a message was received, rejected, redirected, quarantined, delivered, accessed or affected by a rule. Those records may have their own retention periods and permissions.
Act early if they may matter.
If compromise is suspected, preserve:
relevant Inbox, Sent, Drafts, Deleted and Junk items;
mailbox and forwarding rules;
delegated access;
connected applications;
sign-in and session records;
message trace;
recovery and security changes;
and any audit records showing message access or deletion.
That doesn’t mean every enquiry needs all of those things. It means you should make the decision consciously rather than assuming that the visible email contains the whole account history.
Also consider the recipient’s mailbox, not only the claimed sender’s.
The recipient’s copy may provide the best preserved original. Their mailbox may show when it arrived, whether it was replied to, and whether related messages were grouped into the same conversation.
Where several recipients received the email, another mailbox may retain a more complete copy after one user deleted or forwarded theirs.
The common mistake is to preserve only the suspicious message and later discover that the account context has gone.
The opposite mistake is to collect an entire mailbox automatically, creating a large and intrusive dataset with little connection to the question.
Define the issue first.
Identify the relevant account, folders, period, correspondents and provider records. Preserve enough to answer the question and test realistic alternatives.
The email tells you about one message.
The mailbox may tell you about the conversation.
The provider may tell you about the account and delivery system.
Use each source for the part of the story it can actually show.
Key takeaway
The message shows the email. The mailbox and provider may show the surrounding activity. Preserve only what the enquiry reasonably needs, but don’t confuse the two.
Related questions¶
- How do I preserve an email properly?
- What if the sender’s account was compromised?
- Can an email identify the person who wrote it?
- What information may disappear if the message is forwarded or exported incorrectly?
Source notes¶
- Microsoft Learn: Trace an email message in Exchange Online
- Microsoft Learn: Audit log activities
- Microsoft Learn: Use MailItemsAccessed to investigate compromised accounts
- Google Workspace Admin Help: Troubleshoot message delivery with Email Log Search