CYFOR Blog

CYFOR are approached on a regular basis to assist in employee investigations by organisations who have concerns regarding current or former employees.

Employee investigation case study

A Manchester based company that specialised in medical supplies contacted their solicitor, as the IT manager found email correspondence from a Senior Manager to his own personal email address. As this was a contradiction of their company policy they investigated other work-based emails. During this process, they found suspicious correspondence between three parties at their company. The immediate suggestion was that the Senior Manager and the two other individuals were setting up a new company in competition with our client.

The legal team contacted CYFOR for assistance and our immediate advice was to instruct their client not to touch the 3 computers in question and to isolate them. This is in order to preserve the evidence (this is critical in any employee investigation). They wanted an investigation and analysis of all 3 computer devices of those concerned and for us to extract all user-generated data. This was to include emails/Microsoft Word/PDF and spreadsheets, while provided on suitable media for them to review. They were particularly interested in deleted data and whether any data had been copied.

CYFOR’s approach

• We attended the same evening to covertly take forensic images of the 3 computers
• The images were then investigated the following day and all live and deleted data was extracted.
• Software called Internet Evidence Finder was applied over the data and the full internet history was extracted. This included search terms used, whether online storage such as Dropbox had been accessed, social media activity and any reference to personal email correspondence.
• CYFOR looked for evidence of external devices such as USB’s being connected and used for copying.

The Outcome

Evidence was produced within two days and presented to the legal team, which was sufficient for the client to suspend the employee’s pending further investigation. The employees were then dismissed following the client’s thorough review of the evidence CYFOR presented. A substantial amount of Intellectual property had been sent via personal email and via Dropbox, which included database information and client contact details, invoices, health and safety procedures and other in-house documents. Email communication between the three parties also revealed details of their plans to form a new company in direct competition.