Cell phones and tablets are a great resources for finding factual information

Employers should always have a policy that defines what can be done with cell phones and computers. It’s only fair to employees. It also allows employers to manage network problems and find factual information when forensic services are needed.

Case Study: Preserve the evidence – today!

It’s too late.

We commonly get calls from companies who want us to assist in an investigation of a former employee who is now working for a competitor and selling to former clients. Did he steal the proprietary client database?

Figuring this out often involves looking at technical “tracks” of computer activity in shell bags, link files and jump lists. This analysis can only be done if the cell phone or computer is available and hasn’t been wiped. A good way to assure this is to save company owned laptop hard drives and cellphone when an employee departs. Don’t assign them to someone else right away. More ideas for managing employee departures are on this site.

The bad news

Unfortunately, many of these sorts of calls have a sad ending. The ex-employee’s computer and phone have been used by several new employees over the last year. This makes it likely that little forensic evidence remains on the devices. We recommend archiving smart phones and hard drives when a critical employee departs. It costs little and can have a great benefit.