For a serious email incident, preserve evidence before making changes that overwrite or invalidate it.
Useful material can include:
- original raw messages;
- complete headers;
- message/queue identifiers;
- mail-flow or gateway trace results;
- sign-in and identity events;
- mailbox rules and forwarding;
- OAuth/application grants;
- relevant DNS state;
- affected URLs and attachment hashes;
- timestamps and actions taken by responders.
Follow your organization’s legal, privacy and retention requirements. Do not copy sensitive message content into public tools just because it is convenient.