Departed Employee Data Gathering Package
Help counsel and a forensic examiner identify the people, devices, accounts, repositories and short lived records that matter before collection begins.
Edition 2026-11-03 | November 3, 2026
Who uses it: Attorneys, paralegals, HR, project coordinators and client IT.
Scope: Employment, confidential information, trade secret and departure disputes under federal and state rules.
Package 05: Departed employee
Help counsel and a forensic examiner identify the people, devices, accounts, repositories and short lived records that matter before collection begins. Who uses it: Attorneys, paralegals, HR, project coordinators and client IT. Scope: Employment, confidential information, trade secret and departure disputes under federal and state rules.
Before you gather
Begin with the events and dates. Ask counsel to name the issues, custodians, time ranges and preservation priorities, and include records that may support or contradict the allegation. A request for every record on every device slows the work and invites objections.
Preserve before offboarding erases it. Disabling an account, removing a license, transferring ownership, wiping a device or reissuing it can destroy evidence. Coordinate containment and preservation with counsel and authorized IT, and record what changed and when. Synced folders and emailed links often point to cloud copies, so request content, versions, sharing records and identity events from the cloud service as well.
Know the federal claim. The Defend Trade Secrets Act lets the owner of a misappropriated trade secret related to a product or service used in, or intended for use in, interstate or foreign commerce bring a civil action (18 U.S.C. 1836(b)(1)). Information is a trade secret only if the owner took reasonable measures to keep it secret and it derives independent economic value from not being generally known (18 U.S.C. 1839(3)), so gather the access controls, confidentiality agreements, training and marking records alongside the activity records. The action must be brought within three years after the misappropriation is discovered, or should have been discovered with reasonable diligence (1836(d)), and a court may order civil seizure only in extraordinary circumstances (1836(b)(2)). State trade secret, restrictive covenant and employee privacy law varies by state, so counsel confirms which state rules apply.
Match the procedure to the court. Counsel reviews preservation under Federal Rule of Civil Procedure 37(e), proportionality under Rule 26(b), possession, custody or control, privilege, local rules and case orders. Federal Rule 33 ordinarily limits interrogatories to 25, including discrete subparts. In New York state court, CPLR 3130 and the Uniform and Commercial Division rules add their own limits. The sample questions are a drafting bank for counsel to tailor.
Using the worksheets
Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.
Departed employee: records to find
Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.
EMP-R01 Matter facts and timeline
Ask: Counsel and HR.
Gather: Employment or role dates, departure timeline, relevant business files or events, parties, issues and permitted time range.
Where to ask: HR, manager and counsel.
Why it matters: Directs a proportionate information request without presuming wrongdoing.
If missing or uncertain: Separate known facts, allegations and questions.
Sources: LG01 26; NY05 11-c
EMP-R02 Preservation and offboarding status
Ask: Counsel and authorized IT.
Gather: Hold instructions or implementation, relevant retention settings, pending deletions, license changes, account disabling, wipes and replacement or reassignment records.
Where to ask: Counsel, messaging, identity and endpoint owner.
Why it matters: Identifies time sensitive risk of losing relevant information.
If missing or uncertain: Escalate imminent deletion or unknown hold coverage at once; an early hold preserves the most.
Sources: LG01 37(e); MS03; GO01
EMP-R03 Custodian and identifier list
Ask: HR and IT.
Gather: Names, roles, aliases, employee or user IDs, email addresses, tenant or domain IDs, device IDs and relevant shared or group accounts.
Where to ask: HR, identity and asset systems.
Why it matters: Allows the collector to resolve actual identities and sources.
If missing or uncertain: Record gaps for shared or renamed accounts and former or acquired domains.
Sources: NI04; MS01
EMP-R04 Devices and media
Ask: Asset owner and custodian.
Gather: D01 to D03 and any home or personal device used for work, with ownership, location, custody, status and authority unresolved where appropriate.
Where to ask: Asset records and interviews.
Why it matters: Surfaces devices and removable copies beyond the returned laptop.
If missing or uncertain: Ask counsel before seeking personal device data; a forensic examiner images it under that authority.
Sources: NI04; LG01
EMP-R05 Mail calendars and archives
Ask: Messaging and archive owner.
Gather: D04/D08/D19, shared or delegated mail, aliases, mail journals, archive migrations and relevant holds.
Where to ask: Messaging and archive systems.
Why it matters: An individual active mailbox may omit the relevant communications.
If missing or uncertain: Identify archived, inactive or deleted sources and documented capture gaps.
Sources: MS01; GO01; NI04
EMP-R06 Work drives and shared files
Ask: Cloud or file administrators.
Gather: D05/D06/D09/D25, exact site or share paths, owners, external links, versions and relevant sharing records.
Where to ask: File servers, OneDrive, SharePoint, Drive and DMS.
Why it matters: Finds the cloud original and collaboration history beyond synced copies.
If missing or uncertain: List external owner links and recycle bin or hold limitations.
Sources: MS03; MS05; GO01
EMP-R07 Messages and meetings
Ask: Collaboration owners and custodians.
Gather: D07/D10/D11/D12, direct or group chats, external or shared channels, recordings or transcripts and linked attachments.
Where to ask: Collaboration systems and interview.
Why it matters: Identifies communications outside email.
If missing or uncertain: Ask about actual apps, subscriptions, history and limits so the examiner can assess what can be recovered.
Sources: MS02; GO01; SL01; SL02
EMP-R08 Access transfer and security traces
Ask: Security and network teams.
Gather: D13 to D18 and relevant D34; log coverage, earliest or latest dates, field legend, device or IP mappings and permissions.
Where to ask: Identity, SIEM, EDR or DLP, VPN, proxy and cloud admins.
Why it matters: Lets the forensic specialist evaluate leads and gaps.
If missing or uncertain: Describe each alert, download or USB event factually and leave interpretation to the examiner. Record unknown actor or content and missing coverage.
Sources: NI04; MS04; GO02; AW01
EMP-R09 Business and project sources
Ask: Business and application owners.
Gather: D22 to D28, customer or project lists, code or design repositories, tickets and relevant documents/workflows.
Where to ask: CRM, engineering, projects and practice systems.
Why it matters: Can show legitimate work, chronology and alternate explanations as well as disputed activity.
If missing or uncertain: Identify actual modules and export omissions rather than assuming the current report is complete.
Sources: NI04; CL01
EMP-R10 Backups and historical environments
Ask: Backup or migration owner.
Gather: D20/D21, catalogs, retention or overwrite dates, restore dependencies, keys held by owner and earlier export copies.
Where to ask: Backup provider and migration project.
Why it matters: Determines whether potentially relevant earlier copies exist.
If missing or uncertain: Request a cost and scope estimate for an isolated restoration planned by the specialist.
Sources: NI04; LG01 26(b)(2)
EMP-R11 Personal external and third party sources
Ask: Counsel and custodian.
Gather: Known work related external accounts, recipient organizations and relevant third party systems, with the basis for knowledge and control.
Where to ask: Interview and business records.
Why it matters: Enables counsel to choose consent, party request or lawful third party process.
If missing or uncertain: No guessed passwords, bypassing access or blanket demands for private accounts.
Sources: LG01 34,45; NY05
EMP-R12 Collection and response index
Ask: Coordinator and collector.
Gather: What was actually preserved or collected, who performed it, exact scope or filters, date or time zone, hashes where used, errors and missing sources.
Where to ask: Collection report and file index.
Why it matters: Allows the receiving expert to assess coverage and request remaining work.
If missing or uncertain: Record the search terms, scope and errors with every download or zero result.
Sources: NI04; MS06
Departed employee: questions for IT and system owners
A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.
| No. | Question | Suggested responder | Supporting record |
|---|---|---|---|
| 1 | Which accounts and devices did the person use for the relevant work, including shared and renamed accounts? | Client IT or system owner | Identifier crosswalk with dates and ownership. |
| 2 | Which offboarding actions have occurred and what remains scheduled? | Client IT or system owner | Dated action or change records and preservation confirmation. |
| 3 | Where do linked cloud files live, and who owns the external or shared copies? | Client IT or system owner | Exact tenant, site, share or workspace IDs and owner list. |
| 4 | Which tools other than email did the person and coworkers actually use? | Client IT or system owner | Custodian interview notes with apps or accounts and purpose. |
| 5 | What event types were logged at the time and how far back can each source be retrieved? | Client IT or system owner | Coverage or retention table, earliest or latest examples and field legend. |
| 6 | Could a device, account, IP or badge have been shared or used by an administrator? | Client IT or system owner | Assignment, delegation and remote support records. |
| 7 | What migrations, deletions, license changes or policy changes may have affected records? | Client IT or system owner | Change log with known gaps and decision owners. |
| 8 | What does a permitted export include, and which errors or unindexed items does it list? | Client IT or system owner | Export process report and documented limitations. |
Departed employee: sample questions for counsel
These are drafting prompts for counsel to tailor: define the event, source, period and parties, and check relevance, proportionality, privilege, privacy, possession, custody or control, local rules and case orders. A document request, interview or deposition topic may be the better device. The prompts are also in Discovery-drafting-questions.csv.
| No. | Prompt |
|---|---|
| 1 | Identify the custodians of records concerning [defined disputed event] during [period] and each custodian role. |
| 2 | Identify the devices assigned to [person] during [period], including their unique identifiers and current custodian. |
| 3 | Identify the business accounts used by [person] for [defined project], including aliases and shared accounts. |
| 4 | Identify the repositories holding [defined project records] during [period], their responsible administrators and relevant external owners. |
| 5 | Describe the retention or deletion settings applicable to [defined source] during [period], including material changes and known data gaps. |
| 6 | Identify the log sources that record [defined activity] for [period] and the person able to explain their coverage and fields. |
| 7 | Identify the preservation and collection actions actually taken for [defined source], including dates and persons performing them, without requesting privileged advice. |
| 8 | Identify responsive sources not searched or produced and the factual basis for claimed inaccessibility or limitation, subject to the applicable rules and orders. |
Departed employee: decisions and handoff
These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.
Worked example
A returned laptop holds an online only shortcut to a project folder. The coordinator records the shortcut and asks IT for the site owner, the relevant versions and the sharing records. The examiner chooses the collection method; nobody assumes the laptop holds the full folder.
Preparing the handoff
The handoff is ready when counsel has agreed the issue, date and custodian scope and the authority to collect; imminent deletion and offboarding actions are recorded and escalated; cloud services, archives, backups and business systems are covered alongside the endpoints; and the source inventory distinguishes possible, confirmed, preserved and collected locations.
Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.
| ID | Decision | Decision owner | Information needed | Closed by |
|---|---|---|---|---|
| EMP-Q01 | What sources and time ranges are proportionate and within lawful possession, custody or control? | Counsel | Claims, issues, chronology, ownership and proposed source inventory | Counsel approved scope and authority before collection; preserve separately where required. |
| EMP-Q02 | Can the relevant activity be attributed, and what alternatives remain? | Forensic specialist | Original records, timestamps, IDs, mappings and limitations | Expert analysis of the collected records. |
Sources for this package
Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.
LG01 Federal Rules of Civil Procedure (December 1, 2025). Court procedural rules. Rules 26, 33, 34, 37(e) and 45. https://www.uscourts.gov/sites/default/files/document/federal-rules-of-civil-procedure.pdf
NY05 New York Commercial Division rules. Court rules. 11-a, 11-b, 11-c, 11-g and ESI Appendix A. https://www.nycourts.gov/rules/rule/section-20270-rules-commercial-division-supreme-court
MS03 OneDrive retention and deletion. Vendor documentation. Deleted users, unlicensed archives, retention or hold and recycle bin limitations. https://learn.microsoft.com/en-us/onedrive/retention-and-deletion
GO01 Google Vault overview. Vendor documentation. Supported services, licenses, retention rules and holds. https://support.google.com/vault/answer/2462365?hl=en
NI04 NIST SP 800-86. Technical forensic guidance. Sections 3 to 6; collection, data files, operating systems, network or application sources. https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-86.pdf
MS01 Microsoft eDiscovery data sources. Vendor documentation. Mailbox, OneDrive, SharePoint locations; source specific inclusion. https://learn.microsoft.com/en-us/purview/edisc-data-sources
MS05 SharePoint and OneDrive retention. Vendor documentation. Preservation Hold library, versions and recycle bin search limits. https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint
MS02 Microsoft Teams content in eDiscovery. Vendor documentation. Compliance records, files, channels, recordings and known exclusions. https://learn.microsoft.com/en-us/purview/edisc-search-teams
SL01 Slack Discovery APIs. Vendor documentation. Enterprise, approved applications, preserved content and export scope. https://slack.com/help/articles/360002079527-a-guide-to-slacks-discovery-apis
SL02 Slack Connect data management. Vendor documentation. External organization ownership, export exclusions and retention. https://slack.com/help/articles/115004152843-How-data-management-features-apply-to-Slack-Connect
MS04 Microsoft audit retention. Vendor documentation. Audit retention policies by license; check the tenant configuration. https://learn.microsoft.com/en-us/purview/audit-log-retention-policies
GO02 Google audit lag and retention. Vendor documentation. Retention and reporting lag for each log type. https://support.google.com/a/answer/7061566?hl=en
AW01 AWS CloudTrail event history. Vendor documentation. 90 day regional management event history; data events are excluded. https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html
CL01 Clio matter export scope. Vendor documentation. What a matter export contains and the separate subtabs. https://help.clio.com/hc/en-150/articles/9286116462747-Filter-Export-and-Convert-Matters
MS06 Microsoft eDiscovery process reports. Vendor documentation. Search or export scope, location counts, errors and completeness limits. https://learn.microsoft.com/en-us/purview/edisc-process-report
NY06 New York Uniform Civil Rules Part 202. Court rules. 202.20 interrogatories; 202.20-j and Appendix A. https://www.nycourts.gov/rules/part-202-uniform-civil-rules-supreme-court-and-county-court
NY07 New York CPLR 3130. State procedural text. Use of interrogatories and restrictions. https://www.nysenate.gov/legislation/laws/CVP/3130
NY08 New York CPLR 3133. State procedural text. Answers and objections to interrogatories. https://www.nysenate.gov/legislation/laws/CVP/3133
LG03 Defend Trade Secrets Act, 18 U.S.C. 1836 and 1839. Federal statute. 1836(b) civil action and seizure, 1836(d) three year limitation, 1839(3) trade secret, 1839(5) misappropriation. https://www.govinfo.gov/content/pkg/USCODE-2023-title18/html/USCODE-2023-title18-partI-chap90-sec1839.htm
Talk to a senior examiner
Get a free consultation. The initial consultation is free, and requests are handled in confidence.
Call (800) 868-8189 at any hour, or write to info@evestigate.com.
Request a consultation online at evestigate.com/contact.
© 2026 Global Digital Forensics, Inc. All rights reserved.