A 48 Hour Preservation Protocol for Departing Executives and Engineers

By Robert Knudsen, Computer forensics and cybersecurity examiner, Global Digital Forensics

The Critical Final Thirty Days Before a High Value Employee Resigns

Experience across departing employee examinations shows that insider data exfiltration almost always peaks during the fourteen to thirty days before an executive, lead software engineer or top sales director submits their resignation letter. During that window, the departing insider still holds legitimate network credentials and quietly stages proprietary customer lists, pricing models or source code repositories onto personal USB thumb drives, personal cloud storage accounts or personal smartphones via AirDrop and webmail.

What Our Examiners Uncover Inside Quarantined Laptops and Cloud Tenants

Working under the direction of retained employment and trade secret counsel, internal audit or corporate security leadership, Global Digital Forensics reconstructs a departing employee final weeks down to the second. Even when an insider deletes their browser history, empties the Recycle Bin or runs commercial file wiping software before returning their laptop, our examiners recover Windows registry shellbags, LNK shortcut files, Jump Lists, USBstor serial numbers, macOS unified logs and cloud FileDownloaded telemetry. In fact, proving that a departing custodian ran anti forensic wiping tools on a company laptop right before returning it frequently provides trial counsel with powerful evidence of consciousness of guilt at a Temporary Restraining Order hearing.

The First Forty Eight Hours After a Resignation, Hour by Hour

Hour zero is the resignation itself, or the moment a manager hears the rumor. The single most important act in that first hour is a phone call from HR or the manager to counsel, because every later step is cleaner when it happens under direction of counsel. Within the next two hours the account should be moved to a preserved state rather than deleted: sign in blocked, sessions revoked, mailbox and cloud drive placed on a litigation hold, and no one, including the administrator, opening the mailbox to look. By hour four the laptop should be in a sealed evidence bag with a signed chain of custody form, powered off and never booted again by anyone but an examiner. If the employee still has the device, counsel decide whether to request its return immediately or to let the notice period run while the cloud side is preserved, and we advise on which approach keeps the most evidence.

Between hours four and twelve we export the audit records that will expire first. In Microsoft 365 that means the unified audit log entries for the custodian, the sign in logs with device identifiers and IP addresses, the OneDrive and SharePoint FileDownloaded and FileSyncDownloadedFull events and any inbox rules or forwarding set in the final weeks. In Google Workspace it means the Drive audit log, the login audit log and the Takeout history. By hour twenty four the laptop is imaged with a write blocker and the image is verified by hash. Hours twenty four to forty eight are triage: the USB history, shellbags, Jump Lists, browser history with personal webmail and cloud uploads, recently run programs and any trace of wiping software. That triage produces a short preliminary findings memorandum for counsel, which is often what decides whether the matter becomes a demand letter, a negotiated return of the data or a motion for a temporary restraining order.

Access, Copying and Exfiltration Are Different Findings

A departing employee examination lives or dies on the difference between three findings that are often conflated. Access means the custodian opened or viewed a file, which the cloud audit log and the LNK and Jump List artifacts show well. Copying means the file was written to another location, which the file system of the destination, the USB device artifacts, the OneDrive sync client logs or the browser upload records have to corroborate. Exfiltration means the copy left the company's control, which usually depends on the destination being a personal account, a personal device or an external recipient. We write each finding with its artifact support and its limits, because a declaration that says the employee stole the customer list when the record shows only that she opened it will be taken apart at the hearing and will color how the judge reads everything else in the case.

Some of the strongest evidence in these matters is what the employee did to hide the activity. Wiping utilities, mass deletions in the final week, a factory reset of a company phone, clearing of browser history and the sudden appearance of a newly formatted external drive all leave execution and timing artifacts in Prefetch, Amcache, the UserAssist registry key, the USN journal and the SRUM database even when the content itself is gone. The record of concealment supports an inference of intent that courts have found persuasive at the temporary restraining order stage. It also shifts the burden in practice, because a custodian who wiped a laptop two hours before returning it has to explain why. Our departing employee analysis and the flat scope employee exit core analysis are built around documenting exactly these sequences.

Company phones and the personal phones that carried corporate email deserve the same attention as the laptop. A mobile collection shows AirDrop transfers, files saved to personal cloud applications, photographs of screens and documents, and messaging with recruiters or the new employer that places the exfiltration in context. Veronica Perez leads that work, and our supported remote collection runs through a link and a computer connection, usually from a few minutes to overnight depending on the setup, so an executive can keep working while the record is preserved. When the device is personal, collection proceeds under an inspection protocol that counsel agree in advance, and the examination stays within it and documents that it did.

Where Companies Lose the Case Before It Starts

The costliest error is reuse. A returned laptop is wiped and reissued to the next hire within days at most companies, and with it goes the only endpoint record of the final weeks. The second is the informal look, where a manager or an administrator signs in to the departed employee's mailbox and OneDrive to see what was taken. Every file they open gets a new access timestamp attributed to the company, and the other side will argue the company tampered with the evidence or that the files were never confidential because anyone could open them. The third is waiting for proof before preserving. Companies often hold off until a customer reports a solicitation or a competitor releases a familiar product, by which time audit logs have expired and the phone has been traded in. Preservation is inexpensive compared with the matter it protects, and it commits the company to nothing.

Companies also forget the devices and accounts that are not on the inventory. Personal phones that received corporate email through a mobile management profile, personal Dropbox or iCloud accounts signed in on the work laptop, home computers used over VPN and personal printers all hold copies that counsel may be able to reach through an agreed inspection protocol or a court order, but only if the request is made before the employee has had months to clean them. Exit processes that do not collect a signed attestation about company data, do not revoke personal access tokens in GitHub or Salesforce and do not record the serial numbers of devices returned leave gaps that a defense expert will exploit. The departed employee records package sets out what to gather, and our common digital evidence mistakes guide explains why each gap matters.

From Triage Memorandum to Declaration and Testimony

The examination has to be organized from the start around how it will be used. For a temporary restraining order, counsel need a declaration within days that describes the preserved sources, the method, the specific files and the specific transfers, and that stops where the record stops. For a preliminary injunction hearing, the declaration grows into a report with exhibits: the USB device table with serial numbers and first and last connection times, the download event list with file names and timestamps, the timeline that places the wiping tool execution against the resignation and the return of the device. For trial, the report is written to the disclosure requirements of Rule 26(a)(2), with the facts considered, the opinions and the bases for each, so that there is nothing to supplement later under pressure.

The examiner who did the work is the one who testifies, which is how we have handled hundreds of computer and mobile device examinations supporting federal and state court matters. Testimony about forensic artifacts has to satisfy Rule 702 as amended in 2023, which requires the proponent to show it is more likely than not that the opinion rests on sufficient facts, reliable methods and a reliable application of those methods to the case. That is why the report explains what a shellbag is and how it was parsed, what tool was used and how the result was validated, rather than simply asserting a conclusion. Cross examination in these cases almost always probes the gap between access and exfiltration, and an examiner who drew that line carefully in the report has little to fear from it.

Read the Departed Employee Records Package Before IT Touches the Returned Laptop

Keep a suspicious departing employee's computer powered off and out of internal IT's hands until an examiner images it. Read our departed employee records package right now, or call Global Digital Forensics at (800) 868-8189 for rapid preservation and sworn affidavit support. The initial consultation is free.

The First Forty Eight Hours After a Resignation

The guide walks the first forty eight hours hour by hour, because the returned laptop and the cloud account decay on different schedules. This table sets out that sequence, the action at each stage and the reason it matters, so HR, IT and counsel can act before evidence changes. Read the reason column to see how each step keeps the laptop and the account in their current state. Access, copying and exfiltration are different findings, and the triage memorandum states which the record supports.

The worldwide intellectual property case study describes two employees and a manager emailing a customer database and proprietary data to home computers and deleting the messages, the departing insider pattern this guide preserves against.

How to Begin and What Happens on the First Call

Our Insider Threat Checklist: Hold the Accounts, Seal the Laptop sets out the items to secure in the order they expire. Have the basics ready: the employee's name and role, the resignation or termination date, the devices and accounts assigned to them, where the laptop and phone are now and who has handled them, and whether anyone has signed in to the accounts since. The examiner asks what the employee could reach, what has already been observed or suspected, which cloud platform the company uses and whether a litigation hold is in place. You then receive a written scope that lists the sources to preserve in order of urgency, the analysis phases, the timing and the form the findings will take, along with a proposal. The initial consultation is free, and the hotline at (800) 868-8189 answers 24/7.

Technical References and Further Reading

Related GDF pages for this work: cyber vulnerability assessments.

The original article pointed readers to report published by CNN Money. Those references are kept for the record.

Authorities cited in this guide: Federal Rule of Civil Procedure 26, Duty to Disclose. Sets the content required in a retained expert's written report under Rule 26(a)(2)(B), current rule text. Federal Rule of Evidence 702, Testimony by Expert Witnesses. States the reliability showing the proponent must make for expert testimony, as amended effective December 1, 2023. NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. Describes the collection, examination, analysis and reporting phases applied to the returned device and cloud records, final version 2006. Microsoft Learn, Manage audit log retention policies. Documents the retention periods for Microsoft 365 audit records that govern how long cloud download events survive, current Microsoft documentation.