As a business owner, often your most valuable asset is your employees. But what happens when your best employee leaves without reason or mentions she or he is going to work for another company? This should raise a red flag if that employee has access to your company’s sensitive data and/or intellectual property.

Even if you don’t suspect any nefarious motives, in addition to conducting an in-depth exit interview, another pro-active measure a company can take to protect itself is to engage a computer forensic expert to forensically image the departing employee’s computer hard drive (i.e. create an exact bit-by-bit mirror copy).

By having the hard drive imaged immediately, the digital evidence is preserved just as it was the day the employee last laid his or her fingers on the keyboard. Preserving the hard drive has two primary benefits:

• An analysis of the forensic image can be conducted quickly if needed (if, for example, the employee left and “failed to mention” he was going to work for a competitor or open his/her own shop); and
• The evidence would not be trampled upon. Often the company’s IT department will re-issue the computer to another employee thus making forensic analysis more difficult). Even worse, the computer hard drive could be wiped/destroyed and a new one inserted into the shell.

In the event the forensic image does need to be analyzed, the electronic fingerprints the employee left behind can reveal (i) what files were copied to external devices (thumb drives / USB hard drives), (ii) the file folders to which the ex-employee browsed prior to departure, (iii) which websites/cloud storage sites the ex-employee navigated to on the Internet, (iv) the personal or company email the ex-employee sent to her/himself or the new company, and (v) the files s/he may have deleted.

The next time a key employee leaves your company, contact us to discuss which data preservation options best fit your needs.

Post by Steve Hilary, Digital Forensic Examiner
Certified Computer Examiner (CCE)
Encase Certified Examiner (EnCE)
AccessData Certified Examiner (ACE)
New Jersey License Private Detective