Former Employee Investigation Case Study

An organisation specialising in architecture and construction approached CYFOR directly. They had suspicions that a former employee had been sending confidential information to third-party companies.

At the first instruction, it was apparent that data had not necessarily been stolen. However, an analysis of specific company data was required to ‘paint a picture’ of potential misconduct. CYFOR were instructed by the client to securely collect multiple electronic devices from 5 custodians. This was accomplished via our secure in-house courier service.

Analysing the data with Relativity

CYFOR’s forensic investigators could have initiated a targeted review of data with specific client instructions. However, due to the increasing complexity of the investigation and the volume of data (1TB), which far exceeded the initial scope, an online review platform was required. Typically used in complex eDiscovery matters, the Relativity review platform was utilised to search and process detailed keywords that a forensic investigation wouldn’t identify.

In-depth review and analysis

CYFOR forensically collected all devices involved in the investigation, which were predominantly loose hard drives extracted from computers. Using the extensive tools within Relativity, CYFOR’s analysts were able to pre-process and remove system files and extraneous data from the 1TB of data. This was then de-duplicated to reduce the volume of replicated data, across all data sets.

Once filtered, CYFOR supplied the client with a first-stage triage and built a bespoke search index, enabling complex searches across the data, which included keywords, emails, names and addresses. A concurrent system search using Internet Evidence Finder (IEF) supplied a detailed export of data relating to internet activity from the employee Windows user profile.

If you would like to find out more about our former employee investigation case study or our extensive capabilities, then please feel free to get in touch;