Investigating Suspected Employee Data Theft

EMPLOYEEDATATHEFT · AGUIDEFORUKLAWYERS Investigating Suspected Employee Data Theft From First Suspicion to Springboard Relief: The Forensic Investigation Done Right COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM INJUNCTION-SPEED REPORTING CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: exits leave trails, and panic destroys them 03 First response: triggers, containment and what not to touch 04 The exfiltration-artefact map: USB, cloud, email, print and beyond 05 Lawful investigation: UK GDPR, monitoring rules and employment process 06 Attribution, quantification and the choreography timeline 07 Legal deployment: undertakings, delivery-up and springboard relief 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : PRESERVEFIRST , INVESTIGATELAWFULLY , BUILDTHE CHOREOGRAPHY , ANDMOVEFAST : DATA - THEFTCASESAREWONBYTHEQUALITYOF THEFIRSTFORTNIGHT ' SFORENSICSANDLOSTBYTHEITDEPARTMENT ' SFIRST AFTERNOON § 0 2 · FIRSTPRINCIPLES The problem in plain English: exits leave trails, and panic destroys them § 0 3 · THEFIRSTRESPONSE First response: triggers, containment and what not to touch § 0 4 · THETRAIL The exfiltration-artefact map: USB, cloud, email, print and beyond § 0 5 · INSIDETHELAW Lawful investigation: UK GDPR, monitoring rules and employment process § 0 6 · THECASEASSEMBLED Attribution, quantification and the choreography timeline § 0 7 · INTOCOURT Legal deployment: undertakings, delivery-up and springboard relief § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYSTEM ESTATES (§7 ENDPOINT PLATFORM NETWORK / PHYSICAL IMAGE AUDIT LOGS PROXY LAYER MAIL- COUNTERPART RECORDS ROUTES) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESUNDAYHARVESTANDTHEMONDAYRESIGNATION EXAMPLE2 · THELOOK - AROUNDTHATNEARLYLOSTTHECASE EXAMPLE3 · THEARTEFACTSTHATTOLDANINNOCENTSTORY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent (the former employee / new employer) Ask your eDiscovery / forensic provider LETTER ) § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The exit-investigation checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions We suspect a departing employee right now. What are the first three actions? Can we search a leaver's work email and files without their consent? The employee used their personal Dropbox and phone. Can we get at those? What is springboard relief and why the urgency? Our IT team already went through the laptop. Is the case dead? What if the artefacts have an innocent explanation? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab 35 reports produced on injunction timetables and independent-examiner structures offered where personal Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY