Employee Data Theft Investigation

The classic case — copy, then wipe

This is the number one situation Surrey businesses call us about. An employee quits or is dismissed and, during their last few weeks of employment, quietly copies confidential documents, client contacts and pricing onto a USB flash drive, a personal email account and/or a cloud service. Afterwards, the employee restores the computer to its original state via either a "reset" or running a wiping program. Although the employee believes everything has been removed from the computer, that is simply untrue. Forensic analysis is specifically designed for this type of situation. Many items will still remain, even though the employee believed they had completely removed all information from the computer, including when the wiping program was run, which specific wiping tool was used, the burst of file activity during the notice period, and even some of the documents the employee thought were deleted, which can be carved back through forensic methods.

Proving what left on a USB stick

Windows stores an incredible amount of detail about external devices. Each time you insert a USB storage device, the manufacturer's name, model number and unique serial number are stored in the "USBSTOR" registry key, with the last connection date/time held in the registry itself. The first date/time of insertion is recorded in the setupapi log. As such, we can associate each device with the user who inserted it (via MountedDevices and MountPoints2), and identify which of your files were accessed. When a document on a removable media device was opened, there would typically be evidence of this (for example shortcut (LNK) files and jump lists referencing that document on the E: or F: drive, and shellbags referencing the folders browsed on the device). Additionally, the file operations around those dates would be recorded in the NTFS USN change journal. Once cross-referenced, the combination of artefacts moves the case from speculation ('we think they took something') to a documented list of what was taken and when.

Email and cloud exfiltration

Data doesn't just leave on a stick. We look at webmail and browser history for company files sent to a personal Gmail, Outlook or iCloud account, attachments uploaded to WeTransfer, and folders synced to a personal Dropbox, OneDrive or Google Drive. We carve deleted emails from unallocated space, reconstruct download and browsing history, and analyse cloud-client logs to show what was synchronised and when, building an honest picture of every route through which the data could have left the business.

Built for an employment tribunal

The forensic nature of this work (as opposed to just recovering the lost data) lies in the process. We work exclusively from a hardware write-blocked image of the original drive. This image is hashed using MD5 and SHA-256 so that anyone can independently verify that the copy is an exact duplicate and has never been altered. All handling is documented and maintained as part of a formal chain of custody. OSForensics from PassMark performs the "heavy lifting", while password-protected files are handled by Passware Kit Forensic. Once all possible evidence is collected, we create a final report that includes both plain-English summary findings and a detailed technical appendix, allowing the report to withstand scrutiny at an employment tribunal or in court. We will be happy to work under any directions that you agree with your solicitor.

This is one of several situations covered by our wider forensic data recovery service. How we use write-blocked imaging and hashing, and maintain a chain of custody, in every case is explained at length on the main hub page.