Ex-Employee Forensics

Counting The Cost Of Having Your Data Compromised When An Employee Leaves...

When an employee leaves, there is almost always the risk of compromising confidential information. The departing employee may delete or exfiltrate your intellectual property or other sensitive data.

A Typical Scenario

A departing employee copies or deletes confidential information before leaving. The device used by the ex-employee gets transferred to another employee. By the time you discover that sensitive data was compromised, it may be too late. Critical evidence would have been overwritten, making it impossible to pursue legal action or mitigate the consequences, such as the POPI Act breaches.

Why You Should Consider Making Use Of This Service?

Having a forensic copy, made by an independent 3rd party, of the device before or soon after the employee leaves, kept in a safe environment for a set period, followed by having all confidential data removed from the original device before re-using it, will place you in the best possible position to:

Perform a data forensic investigation should it be required in the future.
Pursue legal action.
Minimise leakage of your information by the following user of that computer.
Avoid legal or non-compliance issues due to data retention and data breach legislation.

What Are The Steps? - You Have Three Basic Options To Choose From:

Option1

We make a forensic image of the device (Laptop, Cell phone etc.) on site or in-lab.
The image is kept in a safe environment for 12 months, or longer should you require.

Option 2

We make a forensic image of the device (Laptop, Cell phone etc.) on site or in-lab.
We perform a forensic triage to determine if there are any potential sensitive information was compromised.
The image is kept in a safe environment for 12 months, or longer should you require.

Option 3

We make a forensic image of the device (Laptop, Cell phone, etc.) on-site or in-lab.
We conduct a comprehensive forensic investigation and data recovery, including file carving and a findings report.
The image is kept in a safe environment for 12 months or longer should you require it.

Frequently Asked Questions

Q1 - Can we at a later stage decide to continue with a full forensic investigation?

You can continue a full forensic investigation if the original bit-by-bit image is still in our care or if the provided data image matches the recorded hashing values.

Q2 - Can you keep the original image for longer than a year?

Yes, we can on request, although there is a cost implication.

Q3 - Why do you keep the data image?

It is advisable to keep the image in a safe environment at our premises (a 3rd party) in order to maintain good forensic practices.

Q4 - How long will this take?

The forensic investigation can take as long as 10-15 working days depending on the complexity of the situation.

Q5 - What is the difference between a data recovery and a forensic investigation?

A forensic investigation includes all the processes involved with data recovery, analysing all the data on the drive and drawing up a forensic report on our findings.