Articles
Departing Employee Forensic Investigations
Using Computer Forensics to Investigate Employee Data Theft
When employees leave your employ, they may take valuable electronic files belonging to your organization. If they go to work for a competitor, this can often lead to the competitor gaining an unfair advantage.
All departing employees pose a risk of data loss or theft, most commonly occurring with executives, management, sales, marketing, R&D and engineering positions. In fact, by some estimates, 70% of the value of publicly traded companies is intellectual property in the form of patents, copyrights, trade secrets, financials, formulas, customer & vendor lists, plans/strategies and more. Any disgruntled employee, or one seeking a ‘leg up’ at their new company, is a suspect.
Telltale Signs An Employer Should Look For
Signs that departing employee data theft may have occurred and warrants an investigation include unusual employee activity, such as:
- Plugging a personal USB thumb drive or hard drive into a computer
- Arriving to work at odd hours or establishing remote desktop connections during off-hours
- Transferring large amounts of data on the company network
- Visiting file sharing sites like Dropbox or Google Drive
- Sending emails with attachments to personal accounts
What can an employer do if there are concerns of this activity?
Do not repurpose or tamper with the devices in any way. Don’t even turn them on or off. It could delete important digital content or artifacts that provide relevant evidence!
Instead, include Digital Forensic Preservation in your Employee Departure Program. By incorporating Vestige’s digital forensic experts as part of your employee off-boarding routine, you can get to the truth quickly before extensive damage can take place. Vestige’s forensics experts will preserve digital evidence from all devices and perform effective discovery to uncover any relevant digital evidence that is admissible in court, should litigation become necessary.
Best Practices to Perform for Every Departing Employee
It is best practice to incorporate preservation of all digital device data as it ensures business continuity and adherence to Information Governance policies. Our suggestions to prevent company data theft:
- Organize, secure and archive potential evidence images
- Utilize Vestige’s OaaS forensic collection and preservation service for every departing employee’s digital devices.
- Host relevant metadata in a secure cloud-based environment. This enables secure early case assessment and promotion of relevant data for review and analysis of data including smartphone data, computer
activity and geolocation for any potential internal investigation that requires digital evidence. - Finally, from preservation to presentation, by implementing best practices it is easy, cost efficient and displays the whole story should an internal investigation be required.
Solution
One consideration is Vestige OaaS. The Vestige forensic team provides Offboarding as a Service (OaaS) as a turn-key eDiscovery preservation protocol for preserving legal-hold data from departing employees for corporations who want to be proactive in collecting, preserving and analyzing vital data from these employees. CONTACT Vestige to discuss how to improve your employee departure program or if you currently have digital devices that require preservation and investigation.
by Damon Hacker, MBA, CCE, CISA, CSXF, RP,
President & CEO at Vestige Digital Investigations
