Why the Resignation Week Decides What Can Be Shown
Departing employee examinations show the same pattern across industries. Exfiltration peaks in the weeks before the resignation letter, while the insider still holds legitimate credentials and can stage files onto a personal USB drive, a personal cloud account or a personal phone without tripping an alarm. By the time the resignation arrives the copying is usually finished, and what remains is the record of it: USB device history and shellbags on the laptop, FileDownloaded and sync events in the tenant audit log, and browser history showing personal webmail and cloud uploads. That record is what counsel needs for a demand letter, a negotiated return or a temporary restraining order, and it is lost most often to the company's own offboarding. Our 48 hour preservation protocol for general counsel describes the hour by hour sequence.
The Defend Trade Secrets Act makes preservation a legal position as well as a technical one. Information qualifies as a trade secret only where the owner has taken reasonable measures to keep it secret, and the misappropriation claim requires showing acquisition by improper means. Both elements are proved from records: the access controls that were in place and the forensic trail of what left. The employer's own conduct is examined too. A documented quarantine, a hash verified image and a cloud export made before anyone reviewed the content show that the employer preserved rather than altered. Our corporate espionage guide explains what the access record can show and where it stops.
The Sequence From the Resignation Call to the Verified Image
The first act is a phone call from HR or the manager to counsel, because every later step is cleaner when it happens under the direction of counsel, and the time of that call is noted. Next the account is moved to a preserved state rather than deleted: sign in blocked, sessions revoked, the mailbox and cloud drive placed on a litigation hold through Purview or the equivalent Google Workspace control, and nobody, including the administrator, opening the mailbox to look. Then the laptop, if it has been returned, goes into a sealed bag with a signed custody form, powered off and never booted again by anyone but an examiner. If the employee still holds the device, counsel decides whether to request its return now or let the notice period run while the cloud side is preserved, and we advise on which approach keeps the most evidence.
The exports that expire first follow. In Microsoft 365 that means the Entra sign in logs with device identifiers and IP addresses, which keep seven or thirty days by license, then the unified audit log entries for the custodian with their FileDownloaded, FileSyncDownloadedFull, sharing and inbox rule events, which keep 180 days under standard licensing. In Google Workspace it means the Drive audit log, the login audit log and the Takeout history, retained for about six months. The company phone is isolated and its pending MDM wipe suspended. Every export is hashed and logged. Only then is the laptop imaged through a write blocker and verified by hash, and triage begins: USB history, shellbags, jump lists, browser history, recently run programs and any trace of wiping software. Our departed employee preparation package lists the records in detail.
Who Calls Counsel, Who Holds the Accounts and Who Never Looks
HR or the manager makes the first call and receives the returned hardware, bagging and labeling it without powering it on. Counsel directs the matter from that call, issues the hold, decides when and how the employee or the new employer is contacted and engages the examiner so the analysis runs under its direction. The Global Administrator or Super Administrator holds the accounts and runs the exports from a written list. The MDM administrator suspends remote wipe and retire commands. The security team exports its own log sources. The examiner images and analyzes. Writing those roles into the offboarding procedure, so that HR's notice of a sensitive departure triggers quarantine and hold automatically, is the change that stops the loss from depending on someone remembering to call legal.
The person who never looks is the person with the most reason to. A manager who signs in to the departed employee's mailbox or OneDrive to see what was taken creates a new access timestamp on every file, attributed to the company, and opposing counsel will argue that the employer tampered with the evidence or planted it. A colleague who confronts the employee before counsel has decided how that conversation happens tips off the one person who can still delete, wipe or disclose. Each of those steps can be taken later, from a preserved copy, under the direction of counsel, where it strengthens the record instead of contaminating it.
The Habits That Lose the Case Before It Starts
Reuse is the costliest habit. A returned laptop is wiped and reissued to the next hire at most companies, and with it goes the only endpoint record of the final weeks. The second is the deleted account, where removing the license to save a seat starts Microsoft's documented thirty day purge of the mailbox and OneDrive, and with them the content the audit log's download events refer to. The third is the phone reset on schedule by a mobile device management policy, which removes AirDrop history, personal cloud uploads and the recruiter messages that place the exfiltration in context. Each of those is routine, each is automated at most companies, and each needs a human to pause it the day the resignation arrives. Our departing employee analysis is built around the sequences these habits erase.
The analytical mistake is conflating three findings. Access means the custodian opened a file, which the audit log and LNK artifacts show well. Copying means the file was written somewhere else, which the destination's file system, the USB artifacts, the sync client logs or the browser upload records have to corroborate. Exfiltration means the copy left the company's control, which depends on the destination being a personal account, device or recipient. A declaration that says the employee stole the customer list when the record shows only that she opened it will be taken apart at the hearing and will color how the judge reads everything else. The preservation checklist exists so that all three layers of evidence survive to be examined, and the report is written so each is stated separately.
How GDF Supports Trade Secret Counsel, Audit and Security Teams
Global Digital Forensics has supported trade secret and employment counsel, internal auditors and corporate security teams since 1992, from sixteen US offices and a 24/7 hotline. On the first call we walk the administrator through the holds and exports in order while the laptop is still in its bag, then image it, verify the image and triage the artifacts that matter at a temporary restraining order hearing: USB history, shellbags, jump lists, browser uploads and the execution traces of wiping tools in Prefetch, Amcache, UserAssist, the USN journal and SRUM. The result is a short preliminary findings memorandum for counsel. Our trade secret and employee forensics page describes the device and cloud sources we correlate and why both are needed.
Where the matter involves phones, Veronica Perez leads the mobile collection, and our supported remote collection runs through a link and a computer connection, usually from a few minutes to overnight depending on setup, so an executive can keep working while the record is preserved. Where the matter involves source code, SourceScan comparisons show what was taken and where it reappeared. Our examiners have testified in federal and state courts, our clients include AmLaw 100 firms and Fortune 1000 companies, and the examiner who runs the analysis is the one who signs the declaration and explains it. The initial consultation is free. If a resignation has landed and the laptop is still powered on in someone's office, call (800) 868-8189 before anyone touches it.
The Checklist at a Glance
| Item | Who acts | Where it lives | How fast it expires |
|---|---|---|---|
| Call to counsel | HR or the manager, time noted | Phone, with the time recorded | Every later step is cleaner under direction of counsel |
| Account preserved, not deleted | Global Administrator | Entra sign in block and Purview litigation hold | Thirty days after deletion under the Microsoft default |
| OneDrive and SharePoint download events | Compliance administrator | Purview audit search, FileDownloaded and sync events | 180 days standard, longer by license |
| Microsoft Entra sign in logs | Global Administrator | Entra portal or SIEM export | Seven or thirty days by license |
| Google Drive and login audit logs | Super Administrator | Admin console reports or export | About six months |
| Returned laptop | HR, bagged and powered off | Locked evidence cabinet with a custody form | Lost the day IT reimages it |
| Company phone and MDM wipe | MDM administrator, suspend wipe and retire | MDM console such as Intune or Jamf | A queued wipe executes on the next connection |
| Badge, VPN and endpoint logs | Security team | Physical access system, VPN concentrator, EDR console | Rolls over by log size or vendor retention |
Request the Formatted Checklist
The formatted checklist and workbook edition, a printable control sheet with the hour by hour sequence, custody fields, a hold roster and export log columns for each account and log source, is delivered by a private email link through the request form. Provide your name and email and the link opens the preparation library downloads in your browser. If a resignation has already landed and the device or account is at risk, do not wait for the download. Call (800) 868-8189 at any hour and a senior examiner will walk you through the holds now. The initial consultation is free.