Numbered field checklist for a consumer Google account, usable in two
situations: capturing state before touching anything, and verifying
nobody regained access after a password reset.
Deliberately terse -- steps only, no rationale prose. This is worked
standing up in someone's office, where explanatory text between steps
makes the next action harder to find.
Covers ground sec-google-compromise.md Phase 0 does not: the Takeout
export history, which is the bulk-exfiltration path for a Google account
and produces affirmative evidence in an account tier with no audit log;
recovering Google's own security mail from Trash and Spam via
in:anywhere; pending-but-unconfirmed forwarding addresses; the native
filter XML export instead of a screenshot; and attacker-enrolled
passkeys.
Also records that Gmail keeps only ~10 recent-activity entries, so
signing out and back in destroys evidence -- capture in one sitting.
Placeholders only.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
