Case Study: Departing Employee

viaForensics was approached by the general counsel of a $12B product company (“Client”) who was pursuing a matter with a departed employee (“Employee”). After leaving the company, the Employee began working at the client’s primary competitor.

According to the Client, unless the Employee “had a photographic memory” he most likely stole the Client’s confidential and proprietary information, which violated his employment agreement.

Challenge

Determine whether the Employee removed critical digital assets from our Client prior to his resignation, which could be used as leverage with his new employer.

After the Employee’s resignation, the Information Technology department (IT) redeployed his laptop in the organization to another employee who began using it. A month later, the Client grew concerned and had IT reclaim the Employee’s former laptop. Over the
course of the following week, the IT department made several attempts at recovering information and data, including reactivating the Employee’s user account and logging into the laptop, which in turn destroyed critical evidence.

After their internal IT was unable to locate or recover any critical information, the Client retained viaForensics. Our purpose was to locate and recover information proving the Employee downloaded, copied, printed or otherwise obtained documents for use at his new employer, our Client’s main competitor. Responsiviness was also very important to our client as they believed the damage to their company was increasing each day.

viaForensics Approach

• Initiate Chain of Custody documentation
• Secure a bit-by-bit forensic image of the hard drive in question
• After imaging, securely erase the hard drive for redeployment back into the organization
• Initiate analysis of media by forensics experts to recover data and establish time lines by leveraging proprietary and open source software, specialized techniques and experience
• Submit a detailed Report of Media Analysis for Client’s review
• Establish court admissible evidence
• Provide litigation support on Client’s behalf including affidavits, depositions and expert witness if required

Results

The investigation provided the following context for the days before and after the Employee’s resignation.

Wednesday

• Employee used Google to locate resignation letters, downloaded several and typed his resignation letter that afternoon

Thursday

• Employee printed his resignation letter at 8:30AM on a locally attached printer. We provided Client with the name, model and serial number of the printer.
• Throughout the day, the Employee downloaded and reviewed substantial amounts of confidential data, copying some to removable storage devices. We provided the serial number of the devices.

Friday

• Employee logged into company’s VPN and began downloading documents marked “For Internal Use Only” and “Confidential”. These documents contained product release dates, volume and cost estimates and other highly confidential information. The documents were then printed.
• Employee reviewed confidential documents containing sales and lead information for key products.
• Employee ran CD-ROM burning software and we located evidence that pricing documents were previously burned to CD
• Employee submitted resignation letter which was printed on Thursday

Saturday to Monday

• Employee continued to use computer, including email
• Laptop was returned to the Client.

viaForensics provided a full timeline of when key activities took place, serial numbers of removable storage devices used and confirmations of confidential information taken by the Employee. The Client immediately initiated a Temporary Restraining Order procedure against the Employee and provided sufficient evidence to compel the Employee to produce the removable storage devices for forensic analysis.