Page 1

EMPLOYEEDATATHEFT · A GUIDE FOR UK LAWYERS Investigating Suspected Employee Data Theft From First Suspicion to Springboard Relief: The Forensic Investigation Done Right COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM INJUNCTION-SPEED REPORTING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: exits leave trails, and panic destroys them 03 First response: triggers, containment and what not to touch 04 The exfiltration-artefact map: USB, cloud, email, print and beyond 05 Lawful investigation: UK GDPR, monitoring rules and employment process 06 Attribution, quantification and the choreography timeline 07 Legal deployment: undertakings, delivery-up and springboard relief 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: PRESERVEFIRST, INVESTIGATELAWFULLY, BUILDTHE CHOREOGRAPHY, ANDMOVEFAST: DATA - THEFTCASESAREWONBYTHEQUALITYOF THEFIRSTFORTNIGHT ' SFORENSICSANDLOSTBYTHEITDEPARTMENT ' SFIRST AFTER NO ON

§ 02 · FIRST PRINCIPLES The problem in plain English: exits leave trails, and panic destroys them

§ 03 · THE FIRST RESPONSE First response: triggers, containment and what not to touch