Preserve evidence safely when you suspect misuse of a work account

TL;DR — If you suspect wrongdoing on a work account, do not delete, forward, edit, or "clean up" anything. Create a read-only evidence folder, export the account data and activity logs from the provider dashboard, capture full-page screenshots and email headers, and record SHA-256 hashes (a fingerprint of a file) so you can later prove the files were not changed. Reading time: ~5 min

Goal

When you finish, you will have a timestamped evidence folder on your computer containing original exports, screenshots, message headers, activity logs, and a checksum file, so you can hand over a clear, minimally altered record of what you observed.

Prerequisites

• Your work computer or another approved device with enough free space for exports
• Access to the relevant account in a web browser
• Access to the provider dashboard for the account, if available (for example: email admin, SaaS admin, cloud console, or audit log page)
• A place to store files that you control for this handoff, such as a local folder or approved company storage
• Your current date, time zone, and your full name for the evidence notes
• A browser that can save pages as PDF and take screenshots
• Windows 11, macOS 13+, or Linux with a terminal for hash commands
• Optional: 7-Zip on Windows if you want to create a ZIP archive

Steps

Step 1: Create a dated evidence folder

Use a folder name that includes the date, time, and account name.

Windows:

mkdir "%USERPROFILE%\Desktop\evidence-2026-10-30-1430-work-account"

macOS / Linux:

mkdir -p "$HOME/Desktop/evidence-2026-10-30-1430-work-account"

You should see a new folder on your Desktop with the exact name you used.

Step 2: Write a short evidence note before you click around

Create a plain text note with what you observed first, before you start exporting anything.

Windows (Notepad): Open Notepad and paste this exactly, then save as 00-notes.txt inside the evidence folder.

Date and time observed: 2026-10-30 14:30 local time
Time zone: UTC-05:00
Your name: Jane Example
Account: name@example.com
What you observed first: Unexpected sent emails visible in Sent folder.
What you did before this note: Logged in and stopped. No messages deleted or moved.
Device used: Company laptop asset 1234
Network used: Office Wi-Fi

macOS / Linux:

cat > "$HOME/Desktop/evidence-2026-10-30-1430-work-account/00-notes.txt" <<'EOF'
Date and time observed: 2026-10-30 14:30 local time
Time zone: UTC-05:00
Your name: Jane Example
Account: name@example.com
What you observed first: Unexpected sent emails visible in Sent folder.
What you did before this note: Logged in and stopped. No messages deleted or moved.
Device used: Company laptop asset 1234
Network used: Office Wi-Fi
EOF

You should see a file named 00-notes.txt in the evidence folder.

Step 3: Export account data and audit logs from the provider dashboard

In the account's web dashboard, export data before changing passwords or revoking sessions.

Use your provider's export and audit pages. Common paths are:

• Account or Admin dashboard → Security → Activity / Sign-in history → Export CSV
• Account or Admin dashboard → Audit log / Reports → Export CSV or JSON
• Mail or collaboration app → Settings → Privacy / Data → Export data
• In your provider's dashboard (for example, many services have Security → Sessions or Audit Logs)

Save every export into your evidence folder using these filenames:

01-sign-in-history.csv
02-audit-log.csv
03-account-export.zip

You should see downloaded files in the evidence folder, not just in your browser's default Downloads folder.

⚠️ Do not click buttons labeled "Clear log", "Dismiss alert", "Mark as reviewed", "Revoke all sessions", or "Delete device" yet. Those actions can change or remove evidence.

Step 4: Capture screenshots and save pages as PDF

For each suspicious screen, capture both a screenshot and a PDF.

Open these pages if they exist:

• Inbox or Sent items showing suspicious messages
• Security alerts
• Sign-in history
• Connected apps / OAuth apps (OAuth = sign-in delegation)
• Forwarding rules, filters, mailbox delegates, or API tokens

Save them with literal filenames like:

04-sent-items.png
05-sign-in-history.png
06-forwarding-rules.png
07-sign-in-history.pdf

Browser path for PDF is usually:

• Browser menu → Print → Destination: Save as PDF → Save

You should have image files and PDF files in the evidence folder, each opening correctly.

Step 5: Preserve full email headers for suspicious messages

If the issue involves email, save the raw headers for each suspicious message. Headers are the routing metadata of the email.

In your mail provider, open the message, then use the provider's message details action. Common paths are:

• Message → More actions → View source
• Message → More actions → Show original
• Message → File → Properties → Internet headers

Copy the full headers into a text file named like this:

08-message-header-1.txt

If the provider offers "Download original" or .eml, save it as:

09-message-1.eml

You should have a text file with lines starting with fields like From:, To:, Date:, and multiple Received: lines.

Step 6: Record file hashes for everything you collected

Create a SHA-256 checksum file. This gives each file a fingerprint so later you can show it was not altered.

Windows PowerShell:

Get-ChildItem "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account" -File | Get-FileHash -Algorithm SHA256 | Format-Table Hash, Path -AutoSize | Out-File "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account\99-sha256.txt"

macOS:

cd "$HOME/Desktop/evidence-2026-10-30-1430-work-account" && shasum -a 256 * > 99-sha256.txt

Linux:

cd "$HOME/Desktop/evidence-2026-10-30-1430-work-account" && sha256sum * > 99-sha256.txt

You should see a file named 99-sha256.txt listing each filename and a long hash value.

Step 7: Create a read-only copy for handoff

Create a ZIP copy so you can hand over one package and keep the original folder untouched.

Windows PowerShell:

Compress-Archive -Path "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account\*" -DestinationPath "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account.zip"

macOS / Linux:

cd "$HOME/Desktop" && zip -r evidence-2026-10-30-1430-work-account.zip evidence-2026-10-30-1430-work-account

Then set the original folder to read-only.

Windows PowerShell:

attrib +R "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account\*"

macOS / Linux:

chmod -R a-w "$HOME/Desktop/evidence-2026-10-30-1430-work-account"

You should have both the original folder and a ZIP file, and editing a file in the original folder should be blocked or require you to change permissions first.

Step 8: Hand off the package through the approved channel

Send the ZIP and the original observation note to the right internal team.

Use your company's approved path, such as:

• HR or Legal case portal
• Internal security mailbox
• IT service desk ticket with attachment
• Shared drive folder provided by your investigator

Include this exact summary in the ticket or message:

I observed suspected misuse of work account name@example.com on 2026-10-30 at 14:30 UTC-05:00. I preserved exports, screenshots, message headers, and SHA-256 hashes in the attached ZIP. I have not deleted messages, revoked sessions, or changed settings after collecting this evidence.

You should receive a case number, ticket number, or confirmation email.

Verify it works

Check all of these before you close the browser:

# Windows PowerShell
Get-ChildItem "$env:USERPROFILE\Desktop\evidence-2026-10-30-1430-work-account"

# macOS / Linux
ls -l "$HOME/Desktop/evidence-2026-10-30-1430-work-account"

Expected result:

• You can see 00-notes.txt, exported CSV/JSON/ZIP files, screenshots, PDFs, header files, and 99-sha256.txt
• The ZIP file exists beside the folder
• Opening 99-sha256.txt shows one hash line per file
• Your handoff channel shows a sent message, uploaded file, or case number

Common pitfalls

Downloaded files stayed in Downloads instead of the evidence folder

Mistake: You exported logs, but the browser saved them to the default Downloads folder. Symptom: Your evidence folder is missing the CSV, JSON, or ZIP files. Fix: Move the downloaded files into the evidence folder immediately, then regenerate 99-sha256.txt.

You took screenshots but not the underlying export

Mistake: You only captured images of the activity page. Symptom: Later, nobody can sort, filter, or verify the exact event data. Fix: Return to the dashboard and use the page's Export CSV or Download JSON action, then save it as 01-... or 02-....

You opened or forwarded suspicious email from the account

Mistake: You forwarded messages to yourself or replied from the account. Symptom: Message state changes, new timestamps appear, or investigators ask why the mailbox changed. Fix: Stop sending from the account; preserve the original with Show original / View source and save the .eml or headers instead.

You changed the password before collecting logs

Mistake: You reset credentials first. Symptom: Session and security logs now include your own reset and sign-in events mixed with the suspicious activity. Fix: Note the exact time of the reset in 00-notes.txt, then export logs anyway and tell the investigator which events were yours.

The ZIP hash does not match the original file hashes

Mistake: You hashed the original files, then edited a note or renamed files before handoff. Symptom: Recomputed hashes differ from 99-sha256.txt. Fix: Stop editing, keep the original folder, create a new note describing the change, and generate a fresh checksum file with a new timestamped name.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.