Insider Threat Checklist: Hold the Accounts, Seal the Laptop

Global Digital Forensics checklist. Edition 2026-11-03, November 3, 2026. 24/7 hotline (800) 868-8189.

Customer lists, pricing models and code leave in the weeks before a resignation, and the returned laptop is often the only witness. This checklist is the protocol for holding the devices and accounts and exporting the logs that expire first, before anyone looks.

Why the Resignation Week Decides What Can Be Shown

Departing employee examinations show the same pattern across industries. Copying peaks in the weeks before the resignation letter, while the employee still holds legitimate credentials and can move files to a personal USB drive, a personal cloud account or a personal phone without tripping an alarm. By the time the resignation arrives the copying is usually finished, and what remains is the record of it: USB device history and shellbags on the laptop, download and sync events in the tenant audit log, and browser history showing personal webmail and cloud uploads. That record is what counsel needs for a demand letter, a negotiated return or a temporary restraining order, and it is lost most often to the company’s own offboarding.

Under the Defend Trade Secrets Act, 18 U.S.C. 1839, information is a trade secret when the owner has taken reasonable measures to keep it secret and it derives independent economic value from being kept secret. Misappropriation covers acquisition by improper means and disclosure or use without consent by a person who knew or had reason to know of the duty. Preserve the evidence of what the information is, how it was protected, where it went and who moved it, so counsel can address each element.

The Sequence From the Resignation Call to the Verified Image

Notify legal, HR, security and the technical owners the same day. Account protection and preservation happen together. Administrators record the account and license state and place supported preservation on the mailbox and OneDrive. When the laptop comes back, record its condition and who received it. A laptop that is already off stays off in locked custody. For one that is running, the examiner and technical owner decide promptly about power, network and live capture, and every consequential action is written down with the authority for it.

Give each expiring source an owner: identity and audit logs, endpoint and VPN records, badge access and provider data, with the actual dates, settings, license and export parameters. The MDM owner records pending commands and any approved pause, and the examiner selects how the company phone is isolated. Captured files are hashed and receipts kept. A live device or an expiring log comes first, while the cloud exports run.

Who Calls Counsel, Who Holds the Accounts and Who Waits

HR records when the devices were received, who handled them earlier, their identifiers and their power and lock state. Counsel handles scope, authority and every legal communication. Administrators implement account protection and preservation and record its effect. The examiner and technical owner choose the acquisition method. Security, backup and MDM owners preserve their own sources. Any routine reset, account deletion or device reuse waits for the preservation instruction.

The person who waits is the one with the most reason to look. A manager who signs in to the departed employee’s mailbox or OneDrive to see what was taken creates a new access time on every file, attributed to the company, and opposing counsel will argue that the employer altered the evidence. A colleague who confronts the employee before counsel has decided how that conversation happens alerts the one person who can still delete, wipe or disclose. Each of those steps can be taken later, from a preserved copy, under the direction of counsel.

The Habits That Lose the Case Before It Starts

Removing a Microsoft license, deleting the user and changing a hold are separate events with separate consequences for the mailbox, the OneDrive and the unlicensed archive. Verify each one before acting; each has its own retention clock. Document any scheduled reset of the company phone and stop it through the MDM owner.

The analytical mistake is merging three findings. Access means the employee opened a file, which the audit log and LNK artifacts show well. Copying means the file was written somewhere else, and the destination’s file system, the USB artifacts, the sync client logs and the browser upload records are where the examiner looks to corroborate it. Exfiltration means the copy left the company’s control, which depends on the destination being a personal account, device or recipient. A declaration that says the employee stole the customer list when the record shows only that she opened it will be taken apart at the hearing. The preservation steps here keep all three layers available, and the report states each one separately.

How GDF Supports Trade Secret Counsel, Audit and Security Teams

Global Digital Forensics has supported trade secret and employment counsel, internal auditors and corporate security teams since 1992, from sixteen US offices and a 24/7 hotline. On the first call we coordinate account protection and expiring sources with the device handling plan, choose and document the acquisition method, and examine the artifacts that matter: USB history, shellbags, jump lists, browser uploads and the traces wiping tools leave in Prefetch, Amcache, UserAssist, the USN journal and SRUM. The result is a short preliminary findings memorandum for counsel.

Where the matter involves phones, Veronica Perez, a Senior Computer Forensic Specialist whose work focuses on mobile device evidence, plans the collection, and our supported remote collection runs through a link and a computer connection, usually from a few minutes to overnight depending on setup, so an executive can keep working while the record is preserved. Our examiners have testified in federal and state courts, our clients include AmLaw 100 firms and Fortune 1000 companies, and the examiner who runs the analysis is the one who explains it. The initial consultation is free. If a resignation has landed and the laptop is still powered on in someone’s office, call (800) 868-8189 before anyone touches it.

Preservation and findings record

For each device, record its state, ownership and custody, earlier handling, the authority for each action, the power, network and acquisition choices, and the time and effect of each. For each cloud source, record the controls used, the license, the permissions, the locations, whether the hold activated and any errors. Keep the mailbox, the deleted user OneDrive and the unlicensed archive in separate rows. Credentials travel through a separate secure channel.

For each statement counsel may need to make, record the information or transaction, the source evidence, the original times, whether the record identifies a person, an account or a device, and any competing explanation. Keep acquisition, disclosure and use apart, and note the secrecy measures and business facts counsel will need.

The Checklist at a Glance

The same rows are in insider_threat_checklist_workbook.csv, with columns for the owner, the date, notes, status, the evidence ID and the next action.

Sources