Google Admin Toolbox

Choose the toolbox entry that matches the evidence: Dig for DNS records, Check MX for routing configuration, Messageheader for SMTP headers, or HAR Analyzer for a recorded browser exchange. In HAR Analyzer, choose the HAR file, group requests by page and filter by text or HTTP status. Its timing displays use UTC. HAR files can contain page contents, cookies and submitted information, so inspect the capture before using it. A redaction control downloads a version with sensitive fields removed; review that output before sharing. The analysis covers what the capture contains, since HAR fields can be absent. The guide does not establish that all processing stays on the device.