Did a previous employee steal company data?

Former employees can steal electronically stored information through external storage devices, email, cloud storage websites, and more. If you suspect that a former employee has stolen or misappropriated company data, you need to know exactly what occurred on their electronic devices before their departure.

As a best practice, it’s a good idea to preserve a former employee’s devices. This involves hiring a digital forensics company to create a preservation, or a forensic copy of the device. This ensures that the data has been collected in a manner that is admissible in court. If the device is not preserved and the device is reassigned to another employee, important information regarding the former employee’s actions on the device may be overwritten.
Here are some of things we are often asked to analyze in these types of matters. First, we determine what USB devices were plugged into the machine to determine if file transfers to external devices occurred or what information was accessed on these devices.

We review internet history, including deleted records, which may show access to file sharing websites as well as file uploads.

If you suspect that the employee deleted files prior to turning the device over, specialized software has the capability to attempt recovery of those files, as well as document that activity.

If the method used to facilitate the data theft is unknown, it may be advisable to obtain an overall review of the device activity prior to the departure. This type of analysis tells us if a large number of files were deleted, or if certain programs were removed in the days leading up to the employee’s departure.

At the very least, you should consult with a digital forensic examiner if employee data theft is suspected. This will help you determine the best way to proceed.

If you need digital forensic services, or have any questions about employee data theft, please call us at 703-359-0700.