Employee Data Theft Investigations

Copy first, wipe second — the pattern we see

Ask any employment solicitor in Swansea or Cardiff and they will tell you that this is a common pattern of behaviour for some employees at the end of their employment. An employee will spend all their notice period extracting as much information from the employer as possible including documents, contacts, prices etc. The employee will then move this information to either a stick or to a private cloud account and hand back the laptop with the hard drive fully reset. To anyone looking at the returned laptop, it may appear that no data has been retained; however, to a forensic investigator it would appear that a considerable amount of data has remained. Resets rarely destroy the deeper evidence, i.e. the record of the wipe tool used to carry out the reset and the minute the wipe took place, the flurry of file activity before departure, along with many of the deleted files still being recoverable directly from the disk.

The USB trail Windows leaves behind

Many individuals are unaware of the extent of information that Windows retains about removable devices. Every removable storage device an individual has ever attached, such as a flash or external hard drive, is logged in the Windows registry at the USBSTOR key with its manufacturer, model and serial number. Additionally, the SetupAPI log contains details regarding the date each removable storage device was initially connected to the computer. Furthermore, MountedDevices and MountPoints2 record all removable devices to the specific user profiles they have been used within. In addition to these entries, there are LNK files/shortcuts and jump lists that display what you have opened using a lettered removable storage device. Shellbags can also create additional entries listing what folders were accessed on a removable storage device. Finally, the NTFS USN change journal keeps track of file operations in real time. All of this data, stitched together, provides investigators with sufficient detail to go from a hunch to a dated, itemised account as to what items were removed.

When the data leaves by email or cloud instead

Not all forms of data egress involve physical devices. In addition to reconstructing activities involving browser and webmail access (e.g. attaching documents to private emails, transferring files using file sharing sites, synchronising documents from their work folder to their own OneDrive, Dropbox or Google Drive), we recover deleted emails that have been stored in unallocated space. We can determine via syncing client logs which data was transmitted and when, thus providing an account for every path by which data leaves your company, including those less obvious ones.

Evidence a tribunal can rely on

What separates evidence from anecdotal evidence is procedure. The suspect drive is imaged using a hardware write-blocker; thus no one could possibly say that the image had been modified as all images are verified against MD5 and SHA-256 hashes. All movements of the exhibit will be documented within a chain-of-custody log. The forensic analysis will be run via OSForensics; and where necessary, passwords will need to be broken to access password protected areas using Passware Kit Forensic. When completed the final report will include both the conclusions drawn in simple English along with the technical details contained within an appendix. We have prepared this report to withstand cross-examination at an employment tribunal and we are willing to accept instructions agreed upon with your solicitors.

The disciplines that underpin this web page for forensic image capture, hash calculation and custodial control are outlined in our forensic data recovery hub. All forensic services are payable upfront. A standard investigation includes a full written report which costs £800 + VAT. We also offer a leaner version (£400 + VAT), including forensic binary image and deleted file extraction but excluding the report. Both options are listed on the data recovery cost webpage. If the returned laptop is encrypted we will use our BitLocker recovery service to decrypt its drive using the recovery key prior to commencement of the analysis.