The Decision General Counsel Faces in the Days After a Resignation
The pattern is familiar to anyone who has handled a trade secret matter. A senior engineer, a sales leader or an executive gives notice, the laptop is returned to IT, the account is disabled on the last day, and within a quarter a competitor is bidding with pricing or shipping a feature that looks very familiar. By then the laptop has been reimaged for the next hire, the cloud license has been reclaimed and the audit logs have aged past the platform's retention window. The decision general counsel faces is whether to treat a departure as a routine HR event or as a preservation event, and it has to be made before the facts are known, because once the facts are known the evidence that would prove them is often gone.
The guides in this topic argue for a preservation gate between HR, IT and legal that costs little when nothing was taken and preserves everything when something was. The laptop is imaged before it is reused. The mailbox, drive and audit logs are placed on hold before the license is revoked. The thirty days before the resignation are the window the examination will study, because that is when files are staged, personal cloud accounts are signed in on corporate machines and USB devices appear in the registry for the first time. Under the Defend Trade Secrets Act a claimant must show reasonable measures to keep the information secret, and a documented preservation protocol is part of that showing as well as the means of proving what happened.
How to Read These Guides and in What Order
Start with the departing employee protocol, which sets out the first forty eight hours after a resignation hour by hour and explains what examiners find inside quarantined laptops and cloud tenants. Then read the corporate espionage guide, which turns to the competitor who knows your pricing or roadmap before launch and to the access record that supports injunctions and damages. The source code and research asset guide follows, pairing network exfiltration forensics with expert source code review to address the question the statutes ask, copying versus independent development. Each of the three ends with a section on what the access record can show and where it stops, which is the part counsel should read before drafting the complaint.
The last two guides broaden the frame. The deleted communications guide explains how examiners reconstruct email that was deleted, routed through personal accounts or wiped from a server, and how those facts map onto each element of Rule 37(e). The home office endpoint guide addresses the insider who did not intend to be one, the employee whose personal computer carried an infostealer that handed corporate sessions to an outsider, and the device trust and BYOD examination questions that follow. Read together the five guides cover deliberate theft, careless exposure and the destruction of evidence after the fact, which are the three fact patterns counsel most often has to distinguish between.
What GDF Does for Counsel and Security Teams
Global Digital Forensics has examined departing employee devices and accounts since the firm was founded in 1992, first on file servers and now across cloud tenants. Departing employee analysis and trade secret employee forensics preserve the laptop, the phone where authority exists and the cloud tenant records, then correlate file activity, USB history, cloud sync logs, personal account sign ins and browser artifacts into a timeline of what was taken, when and by what route. GDF Core Analysis offers that work as a flat rate forensic service for an agreed scope covering employee, executive and business partner departures, with preservation, activity analysis and a plain language report, so a company can preserve first and decide later without an open ended budget.
When the matter reaches litigation the same examiners serve as data exfiltration expert witnesses, and when the question is whether code was copied, source code review under a protective order compares the two code bases for structural copying and documents the result in terms a court can follow. Our examiners have testified in federal and state courts and the firm serves AmLaw 100 firms and Fortune 1000 companies as well as the midsize businesses whose entire value may sit in a single repository. For internal security teams the engagement also answers a control question, whether data loss prevention, device management and offboarding scripts worked as represented, and the report says so plainly.
How to Begin
Call (800) 868-8189 or request a consultation online. The initial consultation is free, and in a departure matter speed matters more than completeness, so the first question we ask is where the laptop and the account are right now. If the device is still with IT, do not boot it, image it or wipe it, and do not revoke the cloud license until the hold is in place. We will tell you on the call which logs are closest to their retention limit, what to export tonight and what the examination will cost for the scope you describe. Counsel can engage us directly or through outside counsel, and the work runs under counsel's direction either way.
Before the call, the common digital evidence mistakes guide lists the offboarding steps that destroy evidence, and the digital forensics process guide explains how the examination moves from preservation to a report counsel can use. For companies that want the preservation gate in place before the next resignation, employee exit core analysis describes the standing protocol and how it runs on every departure that meets the criteria counsel sets. Bring the acceptable use policy, the device agreement and the employee's nondisclosure agreement to the first call, since those documents decide what the company may examine.