Employee Investigation | CYFOR Case Study
4th January 2017
CYFOR are approached on a regular basis to assist in employee investigations by organisations who have concerns regarding current or former employees.
The following is a short employee investigation case study, where CYFOR were approached to assist in such a matter.
A local firm to Manchester (provider of medical supplies) contacted their solicitor as the IT manager found email correspondence from a Senior Manager to his own personal email address. This was a contradiction of their company policy, so therefore investigated other work based emails, where they found suspicious correspondence between three parties at their company. The immediate suggestion was that the Senior Manager and the two other individuals were setting up a new company in competition to our client.
The legal team contacted CYFOR for assistance and our immediate advice was to instruct their client not to touch the 3 computers in question and to isolate them, in order to preserve the evidence (this is critical in any employee investigation). They wanted an investigation and analysis of all 3 computer devices of those concerned and for us to extract all user generated data. This was to include emails/Microsoft Word/PDF and spreadsheets, while provided on suitable media for them to review. They were particularly interested in deleted data and whether any data had been copied.
- We attended the same evening to covertly take forensic images of the 3 computers
- The images were then investigated the following day and all live and deleted data was extracted.
- Software called Internet Evidence Finder was applied over the data and the full internet history was extracted. This included search terms used, whether online storage such as Dropbox had been accessed, social media activity and any reference to personal email correspondence.
- CYFOR looked for evidence of external devices such as USB’s being connected and used for copying.
Evidence was produced within two days and presented to the legal team, which was sufficient for the client to suspend the employee’s pending further investigation. The employees were then dismissed following the clients thorough review of the evidence CYFOR presented. A substantial amount of Intellectual property had been sent via personal email and via Dropbox, which included database information and client contact details, invoices, health and safety procedures and other in-house documents. Email communication between the three parties also revealed details of their plans to form a new company in direct competition.