11 / Incident investigation
SECURITY INCIDENT INVESTIGATION
Understand what happened in your Google Workspace.
Understand what happened in your Google Workspace.
Understand what happened in your Google Workspace.
Suspicious sign-in, unexpected forwarding or unusual file sharing? I help you review the available activity, identify immediate next steps and document what we find.
Review the available activity. Document what it shows.
Scope / Review / Report
01 / The scope
A focused review of the activity.
We start with what you have observed and agree the scope of the investigation. The review is guided by the activity and evidence available in your environment.
01Accounts and admin activityReview relevant sign-in and administrator activity.
Review available sign-in and administrator activity for the affected accounts, including changes to roles or settings where logs are available.
02Email forwarding and accessCheck forwarding, filters, delegation and account access.
Check relevant Gmail forwarding, filters, delegation and account access settings for unexpected changes within the agreed scope.
03Drive sharing and connected appsExamine relevant file sharing and connected apps.
Review available file sharing activity, access permissions and connected applications relevant to the concern.
04Findings and next stepsDocument evidence, gaps and practical next steps.
Document what the available evidence shows, identify gaps and agree practical next steps, including any changes or specialist support to consider.
02 / The approach
A clear path from start to finish.
A clear path from start to finish.
A clear path from start to finish.
01
Scope the concern
Scope the concern
Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
02
Review and contain
Review and contain
Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
03
Report and hand over
Report and hand over
Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
A closer look at the process
Scope the concern Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
Review and contain Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
Report and hand over Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
03 / The outcome
Clarity on what happened. A plan for what comes next.
Practical work. Documented decisions. A clear next step.
A focused review of the affected accounts and activity
Appropriate containment steps coordinated with your team
A record of findings, actions and evidence gaps
Recommendations and remaining questions for follow-up
CLIENT EXPERIENCES
What people are saying.
What people are saying.
What people are saying.
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
Stefan Waldschmidt
Zenith Prep Academy
who moved their team to
DNS & EMAIL SETUP
GSE
Altaf exceeded expectations resolving DNS and email issues and delivering a smooth Google Workspace setup. Professional, reliable, and easy to work with. Highly recommended.
Jenny Roberts
ACCOUNT RECOVERY
Freedude Media
Altaf helped us recover critical data and regain admin access to our Google Workspace. Everything was handled securely and efficiently, with no further issues.
Morgan Freedude
WORKSPACE & GMAIL
Gebauer Holdings
Super professional and friendly who understood my needs and came with 5 star suggestions how to streamline my intentions to scale my business. I will continue to use Altaf for my workspace and gmail setup. Again thanks.
Fredrik Gebauer
Read more reviews on Fiverr
One person
One person
One person
who knows
who knows
who knows
the whole picture.
the whole picture.
the whole picture.
I’m Altaf, the person behind Re-solve. I work directly with founders and operations teams to make their websites, systems and everyday tools work better together.
I’m Altaf, the person behind Re-solve. I work directly with founders and operations teams to make their websites, systems and everyday tools work better together.
For Google Workspace, that means understanding how your business runs before changing how your tools are configured. You get direct communication, practical recommendations and someone accountable for the details.
Making
email,
files and
teamwork flow.
Meet Altaf on a call
04 / Before we begin
Good questions. Clear answers.
The investigation depends on your Workspace edition, permissions, available logs and retention. Findings and recovery cannot be guaranteed; specialist incident response or legal advice may be needed separately.
Is this the right service for your team?
This service supports teams concerned about suspicious sign-ins, unexpected forwarding, unusual file sharing or related Google Workspace activity. We start with what you observed and agree a focused scope based on the available evidence.
What activity can you investigate?
The agreed scope can cover available sign-in and administrator activity, Gmail forwarding and delegation, Drive sharing and relevant connected applications. The review follows the concern and the evidence available in your environment.
What limits the available evidence?
Your Workspace edition, permissions, available logs and retention affect what can be reviewed. We document gaps rather than presenting an incomplete record as a complete account of events.
Can you help with containment?
We discuss and coordinate appropriate containment steps with your team as part of the agreed scope. Any changes are considered alongside the activity and settings being reviewed.
Can you guarantee a finding or recovery?
No. Findings and recovery cannot be guaranteed. The investigation depends on the available evidence, and specialist incident response or legal advice may be needed separately.
What will the handover include?
The handover summarizes findings, actions taken, remaining questions and recommendations for follow-up, including any specialist support to consider.
KEEP MOVING
Other ways we can help.
Other ways we can help.
Other ways we can help.
A Workspace account keeps changing. Add the help you need as your people, tools and processes grow.
Discuss your setup
01
Google Workspace migration
Move supported email, calendars and files from Microsoft 365 to Google Workspace, with a planned transfer, tested access and a checked handover.
Email & calendars · Files & access · Planned cutover
A planned move. A checked handover.
02
Workspace security review
Review administrator access, sign-in protection, email authentication and file sharing. Prioritise findings, agree improvements and document the changes.
Account protection · Email security · File sharing
Practical findings. Clear next steps.
03
Google Workspace setup
Set up business email, users, groups and Shared Drives around your team. Test the configuration and hand over clear admin notes.
Domain email · Users & groups · Shared Drives
A working setup. A clear handover.
11 / Incident investigation
SECURITY INCIDENT INVESTIGATION
Understand what happened in your Google Workspace.
Understand what happened in your Google Workspace.
Understand what happened in your Google Workspace.
Suspicious sign-in, unexpected forwarding or unusual file sharing? I help you review the available activity, identify immediate next steps and document what we find.
Review the available activity. Document what it shows.
Scope / Review / Report
01 / The scope
A focused review of the activity.
We start with what you have observed and agree the scope of the investigation. The review is guided by the activity and evidence available in your environment.
01Accounts and admin activityReview relevant sign-in and administrator activity.
Review available sign-in and administrator activity for the affected accounts, including changes to roles or settings where logs are available.
02Email forwarding and accessCheck forwarding, filters, delegation and account access.
Check relevant Gmail forwarding, filters, delegation and account access settings for unexpected changes within the agreed scope.
03Drive sharing and connected appsExamine relevant file sharing and connected apps.
Review available file sharing activity, access permissions and connected applications relevant to the concern.
04Findings and next stepsDocument evidence, gaps and practical next steps.
Document what the available evidence shows, identify gaps and agree practical next steps, including any changes or specialist support to consider.
02 / The approach
A clear path from start to finish.
A clear path from start to finish.
A clear path from start to finish.
01
Scope the concern
Scope the concern
Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
02
Review and contain
Review and contain
Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
03
Report and hand over
Report and hand over
Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
A closer look at the process
Scope the concern Discuss what happened, affected accounts and access needed. Agree the investigation scope before work begins.
Review and contain Review available activity and settings. Discuss and coordinate appropriate containment steps with your team.
Report and hand over Summarize findings, actions taken and remaining questions, with recommendations for follow-up.
03 / The outcome
Clarity on what happened. A plan for what comes next.
Practical work. Documented decisions. A clear next step.
A focused review of the affected accounts and activity
Appropriate containment steps coordinated with your team
A record of findings, actions and evidence gaps
Recommendations and remaining questions for follow-up
CLIENT EXPERIENCES
What people are saying.
What people are saying.
What people are saying.
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
“Altaf helped us migrate from Outlook to Gmail, including complex calendar setups across multiple teams. Everything was handled smoothly, with no double bookings and great support throughout.”
Stefan Waldschmidt
Zenith Prep Academy
who moved their team to
DNS & EMAIL SETUP
GSE
Altaf exceeded expectations resolving DNS and email issues and delivering a smooth Google Workspace setup. Professional, reliable, and easy to work with. Highly recommended.
Jenny Roberts
ACCOUNT RECOVERY
Freedude Media
Altaf helped us recover critical data and regain admin access to our Google Workspace. Everything was handled securely and efficiently, with no further issues.
Morgan Freedude
WORKSPACE & GMAIL
Gebauer Holdings
Super professional and friendly who understood my needs and came with 5 star suggestions how to streamline my intentions to scale my business. I will continue to use Altaf for my workspace and gmail setup. Again thanks.
Fredrik Gebauer
Read more reviews on Fiverr
One person
One person
One person
who knows
who knows
who knows
the whole picture.
the whole picture.
the whole picture.
I’m Altaf, the person behind Re-solve. I work directly with founders and operations teams to make their websites, systems and everyday tools work better together.
I’m Altaf, the person behind Re-solve. I work directly with founders and operations teams to make their websites, systems and everyday tools work better together.
For Google Workspace, that means understanding how your business runs before changing how your tools are configured. You get direct communication, practical recommendations and someone accountable for the details.
Making
email,
files and
teamwork flow.
Meet Altaf on a call
04 / Before we begin
Good questions. Clear answers.
The investigation depends on your Workspace edition, permissions, available logs and retention. Findings and recovery cannot be guaranteed; specialist incident response or legal advice may be needed separately.
Is this the right service for your team?
This service supports teams concerned about suspicious sign-ins, unexpected forwarding, unusual file sharing or related Google Workspace activity. We start with what you observed and agree a focused scope based on the available evidence.
What activity can you investigate?
The agreed scope can cover available sign-in and administrator activity, Gmail forwarding and delegation, Drive sharing and relevant connected applications. The review follows the concern and the evidence available in your environment.
What limits the available evidence?
Your Workspace edition, permissions, available logs and retention affect what can be reviewed. We document gaps rather than presenting an incomplete record as a complete account of events.
Can you help with containment?
We discuss and coordinate appropriate containment steps with your team as part of the agreed scope. Any changes are considered alongside the activity and settings being reviewed.
Can you guarantee a finding or recovery?
No. Findings and recovery cannot be guaranteed. The investigation depends on the available evidence, and specialist incident response or legal advice may be needed separately.
What will the handover include?
The handover summarizes findings, actions taken, remaining questions and recommendations for follow-up, including any specialist support to consider.
KEEP MOVING
Other ways we can help.
Other ways we can help.
Other ways we can help.
A Workspace account keeps changing. Add the help you need as your people, tools and processes grow.
Discuss your setup
01
Google Workspace migration
Move supported email, calendars and files from Microsoft 365 to Google Workspace, with a planned transfer, tested access and a checked handover.
Email & calendars · Files & access · Planned cutover
A planned move. A checked handover.
02
Workspace security review
Review administrator access, sign-in protection, email authentication and file sharing. Prioritise findings, agree improvements and document the changes.
Account protection · Email security · File sharing
Practical findings. Clear next steps.
03
Google Workspace setup
Set up business email, users, groups and Shared Drives around your team. Test the configuration and hand over clear admin notes.
Domain email · Users & groups · Shared Drives
A working setup. A clear handover.