Departing employee and IP theft investigations
An employee has resigned, possibly to a competitor, and you need to know whether they took client lists, pricing or source files. We preserve the evidence first, then answer the question with artifacts that hold up if you go to court.
Reviewed by the ITRS security team · Last updated
Warning signs and when to act
Employers usually call when something does not add up around a resignation. Common triggers:
- A resignation to a competitor, or to start a competing business
- Unusually large downloads, sync activity or emails with attachments to a personal address in the weeks before notice
- A client or supplier mentions being approached by the former employee
- A laptop returned freshly reset, or not returned at all
- Deleted files or mailbox folders discovered after departure
Preserve first: devices, accounts, logs
Quarantine the devices
Collect the company laptop, phone and any external drives. Do not let IT log in to 'have a look', which changes file access dates and can overwrite deleted data.
Hold the cloud accounts
Place the Microsoft 365 or Google Workspace account on hold before any licence is removed or the account deleted. In Microsoft 365 a hold applied before deletion keeps the mailbox as an inactive mailbox.
Export logs that age out
Microsoft Purview Audit records, Entra sign-in logs, Google Workspace Drive and login audit events, VPN and file server logs all have limited retention. Capture them early.
Image, then analyze
We take a forensic image of each device, hash-verified, and analyze the copy. Following ISO/IEC 27037 and NIST SP 800-86 practice keeps the evidence usable in court.
What artifacts can show
Operating systems and cloud services record far more than most people realize. Where files may have gone to a phone, mobile device forensics covers that extraction. Depending on the device, configuration and how much time has passed, examination may show:
| Activity | Where the evidence often comes from |
|---|---|
USB and external drives | Windows registry and event logs or macOS logs showing device connections, serial numbers and times; shortcut (LNK) files and jump lists showing files opened from the drive |
Personal cloud storage | Installed sync clients (Dropbox, Google Drive, iCloud), their local databases, browser history of uploads |
Email to self | Sent items, Purview audit records and message trace showing mail sent to personal addresses, with attachment names |
Company cloud downloads | SharePoint and OneDrive file download and sync events in the unified audit log; Google Drive audit events |
Printing | Print spooler logs and print server records showing document names and times |
Deletion and wiping | Recycle bin artifacts, file system journal entries, evidence of wiping tools or a factory reset |
Workplace investigations and employee privacy limits
Employees keep privacy interests at work, even on company equipment. The Office of the Privacy Commissioner of Canada's guidance on privacy in the workplace stresses limiting collection to what is necessary and making monitoring reasonable, proportionate and minimally intrusive. Which privacy statute applies depends on the employer: PIPEDA covers employee information for federally regulated employers, some provinces have their own private-sector laws, and Ontario requires certain employers to have a written electronic monitoring policy.
We keep investigations focused on the questions counsel has framed, on company-owned devices and accounts. Personal devices, personal cloud accounts and personal email are examined only with consent or a court order, such as an Anton Piller or preservation order obtained by counsel. Where we encounter clearly personal material, we leave it out of the analysis and the report.
Reporting for counsel and injunction support
Departing-employee matters often move quickly toward an interim injunction, so findings come in two stages: a short preliminary summary counsel can use to decide next steps, then a full report or affidavit setting out what was found, the evidence behind each finding, and the limits of the analysis.
Findings are stated carefully. 'A USB drive with serial number X was connected on May 3 and files named Y were opened from it' is a fact the artifacts can support. Whether the employee breached a duty is for counsel and the court. If the matter proceeds, we can act as an independent expert under the applicable rules.
Prevention: offboarding controls
- Block USB storage and unmanaged sync clients on company devices where practical
- Data loss prevention rules for sensitive files and external email
- Audit log retention long enough to look back over a notice period
- An offboarding checklist that holds accounts and preserves devices before anything is wiped or reissued
- Confidentiality and acceptable-use terms that tell staff what is monitored
FAQ
Not necessarily. Cloud audit logs, email records and backups may still hold evidence, and some artifacts can survive on a reused device. Stop further use and call early.
Only with their consent or a court order. Counsel can seek an order where the evidence justifies it.
Usually not from your systems alone. Artifacts show data leaving your control; what happened next generally requires evidence from the employee or the new employer, through counsel.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyEmail Authentication for a Vaughan Smart-Home IntegratorHow IT Rapid Support audited a Vaughan smart-home integrator's email authentication and implemented DKIM and DMARC to shut down domain spoofing.
Related.
- PracticeLegal TechnologyeDiscovery and forensic collection for counsel, expert-ready reports and legal-tech advisory for firms.
- GuideWhat to do if you suspect an employee took company dataWhen you suspect someone is leaving with client lists, files or source code, the order of your next steps decides whether you end up with evidence or with a wiped laptop…
- GuideEmployee offboarding security checklistMost access problems after someone leaves come from process gaps, not technology: nobody told IT, a shared password wasn't changed, or a laptop came back weeks late.
- ArticleElectronic monitoring of employees in OntarioOntario employers with 25 or more employees must have a written policy saying whether and how they electronically monitor staff.
- ServiceDigital forensics expert witnessIndependent analysis of electronic evidence, written up as an expert report that meets the court's requirements and explained clearly under cross-examination.
Acting on a matter that turns on electronic evidence?
Tell us who you act for and what is at issue. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.