The first, least expensive and most important step ….
When you first suspect a data breach or any other cause of action resulting from digital information, the first and most important step is to collect and preserve the evidence. Our team of experts knows exactly how to unobtrusively preserve your evidence, and which techniques to deploy to cull down thousands or millions of data pieces to the key items that really matter to your case.
For employers who suspect digital foul play, the first and most important step is to preserve the evidence. Make sure that the computer the former employee was using is not reissued to a new user as this could lead to all evidence being destroyed inadvertently. Although IT departments are very qualified for technical tasks, you want to avoid having IT searching the machine first, because that complicates the task of computer forensic professionals and could again lead to the inadmissibility or even the destruction of critical evidence. That same advice also applies to mobile and external devices—all of which should be accounted for and preserved. One strategy you can use to retain and protect critical information is to simply remove the hard drive entirely when computers are returned. Another option is to create a forensic image of the hard drive and maintain it for a specified amount of time or until you know it is not needed. When cleaning out the workspace of the former employee be on the lookout for external devices that may have been used as well as passwords written on scraps of paper.
Don’t try and do your own cyber-sleuthing—call in the pros. If there are altered or deleted files, for example, the moment you turn that computer on and start to use it, you risk having any evidence of what happened being overwritten. Any court proceeding will have to account for the full timeline of events: when the employee in question was hired, fired, how long any suspicious activity may have been occurring, etc. The last 4-6 weeks prior to departure is the period that encompasses the most questionable behavior.