Evidence Gap Challenge No. 1: the laptop was reimaged on Tuesday

The call

Meridian Castings is a 400-person manufacturer. On 19 August a supplier telephones their finance team about a €96,000 payment that arrived at an account the supplier does not own.

You are asked to establish what happened. You have one day before there is a meeting with the insurer.

What is already known

4 August, 09:41. Ilona Reku, a financial controller, receives an email appearing to come from an existing supplier, referencing a real open purchase order by number. She reports it to the helpdesk the same morning as "suspicious".

4 August, 14:10. The helpdesk follows the documented process for a reported phishing email on a machine showing no alerts: they reimage the laptop. The drive is not preserved. It goes back into the pool and has been reissued twice since.

11 August. The supplier's bank details are changed in the finance system.

14 August. The payment run executes.

19 August. The supplier calls.

Nobody did anything wrong. The reimage is the documented process, the process was written to get people working again quickly, and it was followed.

The evidence that still exists

Source	Retained	What it holds
Mail gateway	90 days	Delivery record for the 4 August message; sender domain; one rewritten URL, recorded as clicked at 09:44
EDR console	30 days, metadata only	Three alerts on that host in the preceding 30 days, all severity low, all auto-resolved. The agent and its raw telemetry went with the image
Web proxy	14 days	Nothing for 4 August. On-network traffic only, and it records the domain, not the full URL
Entra ID sign-in logs	30 days	Interactive and non-interactive sign-ins for Ilona's account, with IP, user agent and conditional-access result
Exchange Online audit	90 days	Mailbox rule creation, message sends, delegate changes. No MailItemsAccessed, because the tenant is Business Premium, and per-message read events need Purview Audit (Premium)
Finance system	7 years	The bank-detail change on 11 August, attributed to Ilona's account, from a browser session
Firewall	30 days	Connection records by IP and port, no payload, no hostname

There is no disk image, no memory capture and no volume shadow copy. The laptop, as an evidence source, does not exist.

The questions

Work these in order. The order is the method.

Q1

Split every claim you would want to make into two columns: proved by the evidence above, and consistent with the evidence above.

Be strict about the boundary. "The link was clicked" and "Ilona clicked the link" are not the same claim, and only one of them is in the first column.

Q2

The finance system attributes the 11 August bank-detail change to Ilona's account.

State precisely what that record establishes, and what it does not. Then say which other source in the table could move that claim from the second column to the first, and what it would have to show.

Q3

The insurer will ask whether the mailbox was read, whether an outsider saw the invoice thread, the purchase orders, and everything else in it.

Given the tenant's licensing, answer that question honestly, in one sentence you would be willing to put in a report. Then write the sentence you would write if the answer is genuinely unknowable, without either overstating the risk or implying it did not happen.

Q4

One change to collection, made before 4 August, and it has to be affordable for a 400-person manufacturer.

Name it. Then say how many of your column-two claims it moves to column one, and name at least one claim it would not have rescued. That second half is the part people skip.

Q5

Rewrite the helpdesk's reimage process.

The constraint is real: the current process exists because users need working machines, and "preserve every reported phishing host" is not a policy any service desk will follow past the second week. Write something that survives contact with a Monday morning, and state what it costs in machines held and in hours.

Notes on how this is meant to be worked

There is no answer key, and that is deliberate rather than unfinished. The useful output is the two columns and the sentence in Q3, and both of those differ legitimately between analysts. Somebody who puts "the account was compromised" in column one and defends it is doing the exercise correctly even if I disagree.

Two things separate a strong answer from a plausible one:

The second column has to be uncomfortable. If everything you want to say ends up proved, you have not read the retention column closely enough. This scenario is built so that the central question, whether an outsider read the mailbox, cannot be answered from what remains.

Q4 must name what it does not fix. Every collection improvement has a boundary. An answer that presents one as covering the whole gap is the answer that gets a security team a budget once and never again.

Post your answer

Post it in the community, and put the two columns in first. Reading somebody else's split of the same evidence is most of the value of the format. It is the closest thing to peer review that a single-analyst team ever gets.

I will not be marking these. I will be reading them, and the disagreements are the interesting part.

Sources for the constraints used above: Microsoft: Audit solutions overview and licensing · Microsoft: Investigate compromised accounts using MailItemsAccessed · Microsoft: Audit log retention policies · Microsoft: Entra ID reports data retention · MITRE ATT&CK T1114.002: Remote Email Collection

The scenario is invented. The retention periods and the licensing boundary that creates the central gap are documented product behaviour, cited above, and were the starting point rather than a detail added afterwards. No incident data informed this.