It’s cheap to store or image hard drives. This information becomes really valuable when the suit comes in a couple of years (after managers can’t remember the details)

Imagine a difficulty in the workplace. An employee is fired. Years later:

• The supervisor has moved to another company
• Coworkers can’t be located
• Personnel records are found to be vague
• Evidence from access control systems is no longer available
• The computer used by the employee was recycled last year
• A wrongful termination suit arrives.

Q: How can factual information be gathered to make a decision in this case?
A: Save a forensic image of the computer used by the employee before it is reused, recycled or lost.

A policy of imaging computers or just archiving, cataloging and securing hard drives is inexpensive and effective. We like the Ditto hardware for making forensic images.

PS: The same strategy is also effective for employer-owned phones.

Case study: An employee lawsuit.

Five employees of the county falsely sued claiming discrimination. County email backups were available. eSleuth was retained to produce evidence from available sources. We created a forensic image from county computers. Even evidence from a fax machine became important.

The jury decision recognized the truth and gave nothing to the plaintiffs.