Device and application
Accessible client caches, attachments, account identifiers and application records.
Workplace messages, files and organisation records
Lark / Feishu
Forensics.
Assessment of available Lark / Feishu evidence across authorised devices, existing clients and organisation-held sources. Capability is confirmed for the actual product, version, deployment and instruction.
Discuss a deviceExamination
What we can
establish.
Every instruction begins with the questions to be answered. Available evidence depends on the device, software, state, credentials, backups and prior handling.
Account or organisation
Authorised tenant exports or appropriately scoped APIs may provide retained content.
Existing computers
Desktop clients, cached files and authorised exports assessed separately.
Validation and gaps
Lark and Feishu deployments, region, tenant policy, app scopes and membership differ. No unrestricted tenant collection is implied.
Preservation
Record the installed build, tenant or deployment, identifiers, date range and retention position. Avoid updates, new sessions or selective exports before agreeing a preservation plan.
Reporting
Separate native records, selective exports, source omissions and interpretation. Preserve attachments and context, and state which acquisition routes were unavailable.
Evidence source map
Beyond the
visible application.
Absence from one screen or device does not resolve the evidential question. Relevant records may be distributed across several sources.
Local records
Accessible client caches, attachments, account identifiers and application records.
Backup and account
Authorised tenant exports or appropriately scoped APIs may provide retained content.
Existing linked endpoints
Desktop clients, cached files and authorised exports assessed separately.
Limits and corroboration
Lark and Feishu deployments, region, tenant policy, app scopes and membership differ. No unrestricted tenant collection is implied. Lawfully obtained counterpart records may corroborate the source.
Evidential perspective
Authority and configuration define the scope.
Administrator access does not automatically authorise every employee conversation. Licences, roles, retention, encryption, provider changes and the permitted purpose must be established. A feature in provider documentation is not proof of current forensic parser support.
Preserve now
Protect the
best evidence.
- 01Do not reset, update, reinstall or casually browse the application.
- 02Record the device, lock, power and network state.
- 03Identify backups, linked computers and counterpart devices promptly.
- 04Secure known credentials separately and maintain custody records.
Typical deliverables
Acquisition record
Device details, condition, method, tool, integrity information and material acquisition limitations.
Evidence schedule
Relevant conversations, attachments, timestamps, identifiers and supporting artefacts in a reviewable form.
Findings report
Plain-English findings with source references, alternative explanations and express evidential limitations.
Our approach
Proportionate.
Documented.
Explainable.
- 01Authority, objectives and device state confirmed.
- 02Acquisition method selected to preserve the best available evidence.
- 03Findings correlated and tested against alternative explanations.
- 04Clear reporting of methodology, findings and limitations.
Sources and interpretation
Each entry identifies its limited supporting proposition and documentation-check date. General methodology is not a current device-support list. These checks are not laboratory validation; availability and method suitability require assessment for the exact source and configuration.
- Lark message-to-document export
A selective, editable document is not a full acquisition.
Platform documentation · Documentation checked
- Feishu message API
Permissions, membership and app scopes constrain access.
Platform documentation · Documentation checked
- NIST mobile device forensics guidance
Methodological background (2014), not a current device-support list.
General methodology · Documentation checked
Confidential case review
