Ex-Employee Forensics

Counting The Cost Of Having Your Data Compromised When An Employee Leaves.

When an employee leaves, there is almost always the risk of compromising confidential information. The departing employee may delete or exfiltrate your intellectual property or other sensitive data.

A Typical Scenario

A departing employee copies or deletes confidential information before departing. The device used by the ex-employee gets transferred to another employee. It may be too late when you discover that sensitive data was compromised. Critical evidence would have been overwritten, making it impossible to pursue legal action or mitigate the consequences, such as the POPI act breaches.

Why You Should Consider Making Use Of This Service?

Having a forensic copy, made by an independent 3rd party, of the device before or soon after the employee leaves, kept in a safe environment for a set period, followed by having all confidential data removed from the original device before re-using it, will place you in the best possible position to:

Perform a data forensic investigation should it be required in the future.
Pursue legal action.
Minimise leakage of your information by the following user of that computer.
Avoid legal or non-compliance issues due to data retention and data breach legislation.

What Are The Steps? - You Have Three Basic Options To Choose From:

Option1

We make a forensic image of the device (Laptop, Cell phone etc.) on-site or in-lab.
The image is kept in a safe environment for 12 months or longer should you require it.

Option 2

We make a forensic image of the device (Laptop, Cell phone, etc.) on-site or in-lab.
We perform a forensic triage to determine if any potentially sensitive information was compromised.
The image is kept in a safe environment for 12 months or longer should you require it.

Option 3

We make a forensic image of the device (Laptop, Cell phone, etc.) on-site or in-lab.
We conduct a comprehensive forensic investigation and data recovery, including file carving and a findings report.
The image is kept in a safe environment for 12 months or longer should you require it.

Frequently Asked Questions

Q1 - Can we at a later stage decide to continue with a full forensic investigation?

Yes, you can continue a full forensic investigation if the original bit-by-bit image is still in our care or if the provided data image matches the recorded hashing values.

Q2 - Can you keep the original image for longer than a year?

Yes, we can on request, although there is a cost implication.

Q3 - Why do you keep the data image?

Keeping a copy of the data in a safe environment at our premises as an independent 3rd party is advisable to maintain good forensic practices.

Q4 - How long will this take?

The forensic investigation can take 5-15 working days, depending on the complexity of the situation.