Employee Data Theft Investigations

Copy first, wipe second — the pattern we see

Ask any employment solicitor in Swansea or Cardiff and they will recognise the sequence: an employee about to leave spends the notice period harvesting documents, contact lists and pricing, moves them onto a stick or into a private cloud account, then hands the laptop back freshly reset. To the eye there is nothing left; to a forensic examiner there is plenty. A reset rarely destroys the deeper traces — the record of the wiping tool itself and the minute it ran, the flurry of file activity before departure, and a large share of the deleted documents, which can be carved straight back off the disk.

The USB trail Windows leaves behind

Few people realise how much Windows remembers about removable media. The registry's USBSTOR key logs the make, model and serial number of every stick and external drive ever attached; the setupapi log records when each was first plugged in; MountedDevices and MountPoints2 tie a device to the profile that used it. Around that sit shortcut (LNK) files and jump lists showing your documents being opened from a lettered removable drive, shellbags recording which folders on the stick were browsed, and the NTFS USN change journal noting file operations minute by minute. Stitched together, those artefacts convert a hunch into a dated, itemised account of what was taken.

When the data leaves by email or cloud instead

Not every exfiltration involves hardware. We also reconstruct browser and webmail activity — attachments sent to private addresses, files pushed through transfer sites, and folders synchronised out to a personal OneDrive, Dropbox or Google Drive. Deleted messages are recovered from unallocated space and sync-client logs show what went up and when, so the report covers every route out of the business, not just the obvious one.

Evidence a tribunal can rely on

Procedure is what separates evidence from anecdote. The suspect drive is imaged behind a hardware write-blocker and the image verified against MD5 and SHA-256 hashes, so nobody can suggest it was altered. Every movement of the exhibit goes into a chain-of-custody log, the examination runs on OSForensics with Passware Kit Forensic brought in for password-protected material, and the finished report pairs plain-English findings with a technical appendix. It is written to survive cross-examination at an employment tribunal, and we are happy to follow directions agreed with your solicitor.

The imaging, hashing and custody discipline behind this page is set out on our forensic data recovery hub. Forensic work is payable upfront: a standard investigation with a detailed report is £800 + VAT, and a leaner £400 + VAT forensic binary-image and deleted-file extraction is available without the report — both appear on the data recovery cost page. If the returned laptop is encrypted, our BitLocker recovery service decrypts it with the recovery key before analysis begins.