About Us

Cernam is the leader in Office 365 forensics. We uncover hidden
evidence in Office 365, unlocking critical information that can make
or break a case. Our technology enables timely collection and
preservation of evidence, overcoming a key challenge of cloud forensics.


Office 365 Services

Readiness Assessment

  • Office 365 Security Assessment
  • Litigation Readiness
  • Investigative Readiness

Evidence Collection

  • Managed Evidence Collection
  • Self-Service Evidence Collection


  • Office 365 Security and Forensics Training
  • Course designed for Technical, Management and Legal

Consulting Services

  • Strategic Consulting
  • Investigations
  • E-Discovery
  • Security Incidents

Digital Evidence Services


We work with clients on a broad range of e-discovery matters but are particularly proud of our ability to quickly develop custom solutions to address challenging sources such as complex corporate systems, cloud services, personal data stores, social networking sites, collaboration systems and other online sources.


Our greatest strategic value is in helping corporate clients to establish and maintain a right-sized Information Risk Framework. This includes assessing and improving litigation readiness and addressing potential "blind spots" around digital evidence, as well as helping to measure and optimize an organization's "forensic footprint" allowing them to optimize their incident response capability.


Our team has a proven ability to parachute into the unknown and quickly uncover key evidence from complex systems and obscure sources. We routinely locate evidence that clients did not know they had and provide innovative solutions to challenges which others have been unable to solve.


Alongside our consulting services, Cernam also provides technology that embodies our many years of experience in addressing digital evidence stored in cloud services. In a nutshell, our aim is to bring forensic rigor to cloud computing.

Cloud Email Collector

Collect Evidence from Microsoft Office 365

Cloud Email Collector addresses a key limitation of Microsoft Office 365: the inability to easily and reliably collect email evidence.

Cloud Email Collector enables forensically-sound collection of email evidence from Office 365. It provides access to all areas of an Exchange Online mailbox, including Recoverable Items and other system folders which contain valuable evidence. Compared with simple "mailbox export" tools, Cloud Email Collector collects more data and produces a more accurate copy of all required mailboxes.


Identify Use of Cloud Services

Watson is an innovative cloud usage detection tool which highlights the use of cloud services on a corporate network.

Watson is particularly useful in the context of litigation or investigations where it can identify unofficial cloud usage, e.g. unsanctioned use of Dropbox or Google Docs by employees. Once an organization is aware that cloud services are in use, it can take steps to address them when collecting evidence, whereas otherwise these less obvious sources might be overlooked.
Note: Our Cloud Email Collection product is built on "Capture & Preserve", a powerful platform which we developed for collecting evidence from a wide variety of cloud and online sources. This platform can be tailored to work with virtually any online source, e.g. social networks or corporate websites.

If your requirements around cloud or online evidence collection are not addressed above, please get in touch to discuss options around Capture & Preserve or other custom solutions.

Why Us

We go beyond the obvious

The average corporate email passes through numerous systems before being delivered. Are you truly checking all of the systems which could store critical data? We don't simply "look under the streetlight", we reach into systems which are often ignored by other teams and therefore find evidence that would otherwise be missed.

We've run complex enterprise systems

Our team has been designing, implementing and operating complex enterprise systems for decades. We understand that CRM, HR, ERP and financial systems often contain huge volumes of data and that they can be an important source of evidence. We also have the skills to identify and extract relevant data in a defensible manner, without disrupting system operations or imposing undue burden on the IT department.

We uncover evidence others miss

Increasingly, corporate data is finding its way into personal employee accounts, for example on Gmail, LinkedIn, DropBox, EverNote, etc. We have worked with many clients to address the challenges of personal employee accounts and to enable careful selective collection of relevant evidence, in a way that is minimally invasive and therefore facilitates employee consent.


Training Material

Sample training curriculum:
This document provides an overview of the core body of knowledge relating to e-discovery and investigations in Exchange Online that Cernam can customize and deliver.

Training Material


White Papers

Looking beyond email in examining Microsoft Exchange mailboxes:
This white paper aims to show examples of in-mailbox Exchange artefacts and pointers for exploring non-user data in Exchange mailboxes.

White Paper


Case Studies

E-Discovery and Investigations Services for a blue-chip company:
Cernam partnered with the client’s legal team to create e-discovery and investigations strategy.                             

Case Study



While a majority of our work is confidential, the following examples are representative of our work:

Online Evidence Collection

In connection with high-profile litigation, collected evidence from the personal email accounts of a group of employees and executives, enabling true evidential collection from a challenging source while maintaining employee privacy.

Complex E-Discovery

Managed a multi-year project to identify, preserve and collect digital evidence for several hundred custodians across the US and Europe, including evidence from PCs, email mailboxes, home directories, enterprise applications and cloud based email systems.

Legacy Litigation

In respect of "legacy" litigation from several decades previously, analyzed terabytes of "abandoned" content on fileservers and restored multiple decommissioned systems to identify any relevant evidence which might still exist.

Security Breach Response

For an organization affected by a complex security breach, led the incident response effort including analyzing the nature and scope of the compromise, determining the precise data which had been exposed, and guiding effective decision making and communications.


Engaged by a large public company to develop an information risk framework that provided an appropriate level of protection from cybersecurity threats and enable the CIO to provide an appropriate level of controls assurance to internal and external stakeholders.

E-Discovery and Investigations

Assisted a blue chip organization optimize their approach to dealing with e-discovery and Investigations and in the process establish a stronger partnership between the IT and Legal department resulting in a more streamlined and cost effective process.


"I have relied on the Cernam team to co-ordinate all e-discovery activities at Élan for many years and have always been impressed by their timely, efficient and thorough response on all matters. They have been able to seamlessly co-ordinate all relevant activities between our internal IT team and external counsel and have worked with the legal group to develop a cost-effective model for the identification, collection and processing of responsive electronic material"

VP Intellectual Property & Litigation