How can I preserve Microsoft Teams chats as auditable evidence?
I’m a lawyer in my first year of practice, working remotely for a law firm. Over the past year, I followed various instructions from senior colleagues that were presented to me as legitimate professional tasks. I recently discovered that some of these instructions may have been connected to potentially fraudulent or criminal conduct, and I’m concerned that I could be implicated despite having acted without knowledge or intent.
I need to preserve my Teams conversations as evidence showing the instructions I received and the context in which I acted.
I don’t want to rely on screenshots or manually copied messages. I’m looking for a complete, auditable and traceable export, ideally preserving timestamps, participants, message IDs, edits/deletions, attachments and relevant metadata, with a way to demonstrate the integrity of the data afterward.
From what I understand, Microsoft Purview/eDiscovery may allow an administrator to do this. However, I’m concerned that asking the administrator—who may be closely connected to my supervisor—could raise suspicion before I understand my options.
Is there any legitimate way for an individual Teams user to preserve/export their own conversations in a forensically reliable manner without involving the company administrator?
If not, what is the technically best approach (Purview/eDiscovery, Graph API, or another method), and what should I preserve to establish authenticity and chain of custody?
I’m specifically looking for advice from Microsoft 365/Teams administrators, eDiscovery specialists, or digital-forensics professionals.