“Departing Employees, Data Theft, and Digital Forensics” by Sensei’s Mike Maschke and Brandon Barnes was featured in a recent blog post by ACEDS. The Association of Certified E-Discovery Specialists (ACEDS), part of leading legal education provider The BARBRI Group, is a global member-based association for professionals who work in e-discovery, information governance, compliance and the broader legal community.
In late 2019, it was reported by Infosecurity Magazine that 72% of former employees admitted taking company data with them upon departure. Determining what actions a former employee took on a company device leading up to their departure can help assist in determining if company data was stolen or misappropriated. Did the departing employee retire or leave for a competitor? Where they forthcoming with their intent to depart or was it abrupt? Depending on the specifics of the situation, it may be advisable to perform a digital forensic investigation to help locate some answers.
It’s Never a Bad Idea to Preserve a Former Employee’s Devices
When an employee makes the decision to leave a company, it may be time to forensically preserve the contents of an employee’s business device(s), including cloud-based accounts. We are talking about devices provided by the employer for the employee to conduct their work and not personal devices. This will ensure the digital data has been collected in a manner that is admissible in court (should that be the outcome). If the device is not preserved and is reallocated to another employee, important information regarding the previous employee’s actions on the device may be overwritten.
Once the devices used by the employee have been forensically preserved, analysis may begin.