Email used to be predictable. You collected the mailbox, and you received the message and its attachments as a clean parent–child family. Modern collaboration has changed that. A growing share of “attachments” are now links to Google Drive, OneDrive, or SharePoint. The link may hold the evidence, and the email is only the pointer.
In this episode of the Meet and Confer podcast, Kelly Twigger talks with Arman Gungor, a forensic practitioner and the creator of Forensic Email Collector and Forensic Email Intelligence. Arman has been working in this space since the early cases that put modern attachments on the court’s radar, and he walks through the realities behind these linked files.
What modern attachments really are
A hyperlinked file is not a traditional attachment. It is a cloud object that can change, move, or disappear while the email stays the same. You cannot understand the communication without the file, which puts it squarely in the context of the message for discovery purposes.
What the major systems can and cannot do
Google Vault now exports linked Drive files, but only the current version and only as single instances. You must rebuild the connections if you want a complete family. Microsoft’s environment is harder. Purview does not give you a reliable way to find all linked messages or collect the correct versions. In both systems, access rights and shared-folder links can limit what a party can produce.
Why versions matter
The version question carries real risk. The file a custodian sees today may not match the file they saw when the email was sent. If you need the contemporaneous version, you have to plan for it and use tools or workflows that can isolate it based on the timing of the message.
Preservation is still unsettled
Linked files raise preservation issues that traditional holds do not cover. Holding the mailbox does not guarantee the Drive or SharePoint content is preserved, especially when access changes or the file belongs to someone outside the organization. These gaps surface months later when it is too late to fix them.
What litigators should decide early
At the meet and confer, decide:
- Whether modern attachments are in scope
- Whether you need current or contemporaneous versions
- How to handle shared folders and recursion
- How the parties will approach volume and burden, including sampling when appropriate
Hyperlinked files are no longer a technical edge case. They are a routine part of how people work. The sooner you understand what the systems can deliver and where the limits are, the stronger and more defensible your discovery decisions will be.
That’s exactly the kind of strategic decision-making Minerva26 is built to support. Connecting rulings, rules, and real-world workflows, so you can make faster, defensible choices that protect credibility, control costs, and tell a compelling story with ESI.
To hear the full conversation, including the technical nuances, workflow impacts, and what’s coming next for modern attachments, listen to the complete episode here.
