For Lawyers


Employee Investigation Mysteries

The famous Sanborn sculpture, Kryptos, illustrates a need for thoughtful investigation techniques to solve difficult problems

The famous Jim Sanborn sculpture, Kryptos, illustrates a need for thoughtful investigation to solve difficult problems

If evidence is obvious, anyone can find the solution to a mystery without an investigation.

We specialize in cases that require more than a superficial understanding of details. The situation gets particularly complex when false information is planted during the investigation, computers are altered or details are forgotten. This is similar to the issue faced in the “wilderness of mirrors” by counterintelligence operations.

Case Study: Catching an employee who hid his tracks

The mystery had lots of moving parts: encrypted computers with unknown passwords, an access control system that was bypassed, good video coverage which coincidentally had been deleted from servers, and a company policy generously rewarding longevity. One employee was suggesting others were culprits, had an alibi that turned out to be forged,… and was the incompetent manager who we identified as the crook. His longevity and six figure salary were shortened by our investigation. We worked as part of an investigative team in this case. Digital evidence was a valuable clue. Broad capabilities let us reach a conclusion.

Launch an Investigation

If you think that your client faces a multi-dimensional challenge of this sort call (888) ESLEUTH.  Be careful to preserve critical information that may be in network logs, company PCs, cell phones, access control systems or video security systems.  They will be important when an investigation begins.  Resist the temptation of the IT department to “just fix” the PC that may have been altered without preserving evidence on the machine using forensic techniques.

Act on investigative results

As investigators the good days at work are discovering factual evidence that give clear conclusions for our clients.  The worst days are when our client doesn’t take action.  Here’s an example:  We were retained by a local government that was being sued by  employees.  The computers that we analyzed clearly showed that the employees were faking their claims.  In the process they were falsely accusing innocent parties. The case went to a jury that agreed with the facts and threw out the suit.  Unfortunately, years later these still had their jobs. No action was taken!