How to Determine Whether an Employee Copied Company Files

When an employee departs, or misconduct is suspected, a primary concern for organisations is the exfiltration of sensitive company data. Identifying whether an employee has copied company files requires a structured, forensically sound approach, focusing on digital trails that are often invisible without specialist tools and expertise.

Understanding the digital footprints left by file copying activities allows for targeted investigation, evidence preservation, and ultimately, informed legal or disciplinary action. Early detection and expert analysis are crucial to mitigating risks and proving intent in such cases.

Understanding File Copying Mechanisms and Digital Traces

Employees can copy company files through various methods, each leaving distinct digital traces. Common mechanisms include USB drives, personal cloud storage services, email attachments, network shares, and even printing. A forensic investigation must consider all these avenues to ensure comprehensive coverage.

When a file is copied to a USB drive, for example, the operating system records events such as device connection, file access, and often the creation of shadow copies or link files. Similarly, uploads to cloud services leave traces in browser history, application logs, and network traffic records. Email attachments are recorded in sent items and mail server logs. Understanding these underlying mechanisms is fundamental to knowing where to look for evidence.

Key Data Sources for Investigation

• Endpoint Devices: Employee workstations and laptops are primary sources. Forensic images of these devices can reveal file system artefacts, event logs, registry entries, and browser history.
• Server Logs: File servers, SharePoint, and other centralised data repositories maintain access logs, showing when files were accessed, by whom, and from where.
• Network Logs: Firewalls, proxy servers, and network monitoring tools can record outgoing traffic, including uploads to cloud services or large email attachments.
• Email Systems: Exchange, O365, or Google Workspace logs provide details of emails sent, including attachments, recipients, and timestamps.
• Cloud Service Logs: If company data is stored in sanctioned cloud services, these platforms often provide audit logs detailing file access, downloads, and sharing.
• Removable Media Forensics: Specific analysis of USB devices or external hard drives may be necessary if they are recovered.

The eDiscovery Workflow and Insider Threat Investigations

Identifying file copying aligns closely with established eDiscovery principles, requiring a structured approach from identification to disclosure.

Identification: This initial stage involves pinpointing potential data sources. Which employee devices were used? Which network shares were accessed? What cloud services might have been involved? This requires collaboration with IT and HR.

Preservation: Once potential sources are identified, immediate steps must be taken to preserve the data. This involves creating forensic images of endpoint devices, preserving server logs, and placing legal holds on email and cloud data. Adherence to ACPO principles or equivalent forensic best practice is critical to maintain evidential integrity.

Collection: Data is then forensically collected from the identified sources. This ensures the chain of custody is maintained and data is not altered. Collection methods vary by data source, but always aim for bit-for-bit copies where possible.

Processing: Collected data is then processed to make it reviewable. This involves extracting metadata, indexing text for search, and de-duplicating files. For file copying investigations, particular attention is paid to file system artefacts and logs.

Review and Analysis: This is where the core investigation occurs. Forensic analysts use specialist tools to examine system logs, registry artefacts, link files, shellbags, jump lists, and browser history. Keyword searches for sensitive data, analysis of file creation/modification/access times, and examination of USB device connection logs are paramount. Unusual activity patterns, such as mass downloads or access outside working hours, are key indicators.

Disclosure/Reporting: The findings are compiled into a clear, concise forensic report, detailing the methodology, evidence found, and conclusions. This report forms the basis for any subsequent legal or disciplinary action and must be suitable for disclosure in civil litigation under CPR Part 31 or PD 57AD.

Practical Steps for Detecting File Copying

A systematic approach is essential. Here are the key steps:

• Define Scope: Clearly identify the employee(s) of concern, the timeframe, and the types of data potentially copied.
• Secure Endpoint Devices: Ensure the employee's workstation or laptop is taken offline and forensically imaged. Do not allow further use.
• Analyse System Logs: Examine Windows Event Logs (Security, System, USB device events) for signs of removable media connection and large file access.
• Registry Artefact Analysis: Investigate registry keys related to USB usage (e.g., MountedDevices, USBSTOR) and user activity (e.g., LastAccessed). Tools like RegRipper can automate this.
• File System Analysis: Look for link files (.lnk), jump lists, and shellbags that record user interaction with files and folders, including those on external drives.
• Search for Keywords and File Types: Use forensic tools to search for specific filenames, sensitive keywords, or file types (e.g., .zip, .rar, .pst, large documents) that might indicate exfiltration.
• Network and Email Log Review: Work with IT to review firewall logs for unusual outbound connections, proxy logs for cloud service uploads, and email logs for large attachments.
• Cloud Audit Trail Review: If company-sanctioned cloud storage was used, review audit trails for abnormal downloads, shares, or synchronisation activity.
• User Activity Monitoring: If implemented, review logs from Data Loss Prevention (DLP) or User and Entity Behaviour Analytics (UEBA) systems for alerts.
• Interview Key Personnel: Gather context from IT and HR regarding the employee's role, access levels, and any previous concerns.

Common Indicators of Data Exfiltration

Several indicators, when found together, can strongly suggest that data has been copied or exfiltrated.

• Unusual USB Device Activity: Frequent connection of unknown USB devices, or large data transfers to legitimate ones, particularly outside of normal business operations.
• Mass Downloads: Large volumes of files accessed or downloaded from network shares or cloud platforms by a single user, especially if these files are outside their usual scope of work.
• Access Outside Business Hours: Significant data access or transfer activity during evenings, weekends, or holidays.
• Use of Personal Cloud Storage: Evidence of logging into or uploading files to services like Dropbox, Google Drive, or OneDrive via the company network or device.
• Large Email Attachments: Sending emails with unusually large attachments to external recipients, particularly personal email addresses.
• Printer Activity: High volume printing of sensitive documents, especially if unusual for the employee's role.
• File Compression or Archiving: Creation of .zip or .rar files, which can consolidate many smaller files for easier transfer, often without an explicit business reason.
• Deletion of Artefacts: Evidence of clearing browser history, deleting temporary files, or attempting to erase system logs.

Reporting and Legal Considerations

Once the investigation is complete, a clear and objective forensic report is paramount. This report must detail the findings, methodology, and the evidentiary basis for conclusions.

Legal considerations include adherence to UK GDPR, particularly if personal data is involved. The processing of employee data must be necessary and proportionate. Under the Bribery Act 2010, exfiltrated data might reveal improper conduct. Disclosure of findings in litigation will be governed by CPR Part 31 and PD 57AD, requiring careful consideration of privilege. It is crucial to consult with legal counsel throughout the investigation to ensure all actions comply with legal and regulatory requirements and that evidence will be admissible.