As of June 1, 2024, Vestige Digital Investigations is part of ArcherHall, a leading digital forensics, 
e-discovery, and cybersecurity service provider. The Vestige team that you know and trust will
continue to serve you at ArcherHall. Our expanded team, capabilities, and infrastructure will allow
us to serve you and your clients even better.

HR: The many advantages of utilizing Digital Forensic Experts when Conducting a Workplace Investigation


HR: The many advantages of utilizing Digital Forensic Experts when Conducting a Workplace Investigation

Author photo
Senior Forensic Analyst

A digital forensic expert can assist in scoping and help guide the investigation

Every HR investigation is different. In terms of evidence, some circumstances involve email as the primary source of evidence. Others consist of computer and mobile phone data. When presented with the background of a workplace investigation, a forensic expert is able to compile a list of data sources that may be relevant to create a more efficient and targeted human resource investigation.

There will be unforeseen twists and turns that are dictated by evidence that is uncovered. Some examples include a wiping tool was run on a computer, a personal cloud storage platform was used to steal company files, or the suspect of the investigation dishonestly withheld a flash drive containing confidential data. When these situations happen, the forensic expert performing the analysis will be able to follow each and every lead to determine the facts.

Vestige, having worked thousands of digital forensic cases in the past, is particularly equipped with the knowledge, experience, and expertise to scope any workplace investigation and assist clients every step of the way.

A forensic expert can uncover evidence below the surface

Valuable evidence resides in numerous locations on digital media, many of which require the specialized techniques and expertise of a forensic expert. Using forensic tools and techniques, a forensic expert can:

  • Investigate employee data theft to determine if proprietary data was taken when an employee exited their job
  • Review communications, email or text message, relevant to allegations of sexual or other forms of harassment.
  • Assess the impact of data destruction and potentially recover the deleted data.

A cursory knowledge of electronic media is simply not enough to really dig into the available information or make sense of the bigger picture when it comes to digital forensics and cyber crime. Potentially pivotal evidence could be missed or overlooked in HR investigations. In this day and age, in which technology is so infused with daily business operations it is almost a necessity that a digital forensic expert is involved from the start.

Gathering and reporting relevant evidence is a quick and simple process

When working with Vestige, after evidence has been preserved and the analysis is underway, the next step is identifying relevant evidence in the context of the investigation. This can be achieved through multiple means, such as performing keyword searches, reviewing forensic artifacts for specific file or folder activity, or reviewing all activity from the device during a specific date range. Once relevant information is gathered, the findings are conveyed to the client verbally or presented in a report, depending upon the needs of the client. Vestige also “translates” the technical information into easy-to-understand concepts so clients can quickly understand the results of the analysis and build their case.

For additional information regarding the forensic services Vestige can provide HR and employment law professionals, visit our Human Resources page:

Ian Finch for web

By Ian Finch, BS, GCFA,
Senior Forensic Analyst
Vestige Digital Investigations