Rate this item
(0 votes)

The Role of forensics after employee data theft has occurred

In a previous post we addressed the underlying issues and harm caused by an ex-employee stealing confidential company information. We discussed that having internal policies in place to prevent data theft which often entails fostering an environment where employees have limited access to confidential data from their initial hire date. The unsettling reality that cannot be overlooked, however, is that even with the implementation of a thorough policy, a resourceful and persistent employee will inevitably be able to steal Company data. Rather than allowing an atmosphere of paranoia to kick in and envelop your Company, the best method to approach this scenario is to rely on forensics examiners to help demonstrate that the ex-employee took information without consent which will undeniably cause harm to the company.

Ultimately, in this context what you don’t know can hurt you. Professional assistance ensures a greater likelihood of not only effective data theft prevention, but also assessing the damage after the fact with the goal of bringing the ex-employee to *justice (*tune into future posts for legal recourse against an ex-employee). Computer forensics experts can locate evidence of an employee’s improper conduct using specialized software, hardware and techniques.

To offer examples, consider that computer forensics experts can determine if an employee connected a device such as a USB storage device or if a CD was created which contained confidential data. An expert can even identify the make, model and serial number of the removable storage device, when it was first connected and the last time it was used, which data was deleted or stolen, and often times can even recover the information itself. All relevant information is taken into consideration such as the most recent document printed, website loaded, or program downloaded by the ex-employee may leave a trail and lead to more information about the theft itself. Or perhaps the forensic examiner will review the recently viewed websites by an employee to shed more light on forensic the examination.

Legal Evidence Corporation in role of forensic examiner

Legal Evidence Corporation will approach an employee data theft matter by conducting a forensic investigation to gather all information which may be relevant towards uncovering the underlying circumstances surrounding the data theft. Depending on the nature of the matter, a mobile forensics investigation may be undertaken in which the examiner will review a smartphone (such as an iPhone, Blackberry or Android phone) for information which can provide significant insight into what an employee was doing in the months and days leading up to the data theft. Whether examining active or inactive files, voicemails, emails sent or received, text messages, contacts, call logs and pictures, can all prove beneficial to a forensic examiner.

Furthermore, DFC incorporates GPS technology into an examination to better pinpoint the whereabouts of an ex-employee’s location at a particular date and time. Since this may implicate privacy concerns, we encourage our Clients to seek the advice and counsel of an experienced attorney before proceeding with all aspects of the examination.

More in this category: « IP Law and digital forensics

Leave a Reply

Your email address will not be published. HTML code is not allowed.