Scope a flat rate Core Analysis
Agree a focused first examination, the question it will answer and the sources it will cover before any work begins.
Departing Employee Forensics, Preservation and Transfer Analysis
Know What a Departing Employee Took and Where It Went
An employee has resigned and the laptop is due back Friday. Global Digital Forensics preserves the company computer, phone, mailbox and cloud accounts before offboarding wipes them, then traces every USB connection, upload, forward and deletion in the final weeks. You get a timeline that supports a demand letter, an injunction or a decision to close the file.
Before offboarding
Preserve the Evidence Before Offboarding Erases It
The offboarding checklist that protects the company on the day someone leaves also destroys the record of what they did in their final weeks. A reissued laptop, a deleted mailbox or an expired audit log can leave a strong departure case with nothing to show. We tell counsel, HR and IT what to hold, what to image and what to leave untouched, so security and evidence both survive the exit.
Preservation that fits the offboarding calendar
We separate the steps that must happen before access changes from the imaging and exports that can follow, so IT works from a short list instead of an order to save everything.
Device and account activity read together
The laptop, mailbox, cloud storage and repository records are correlated, so a file event is judged beside the message, upload or login around it.
A timeline you can act on
Every finding names the record behind it, which is what the choice between a demand letter, an injunction and a closed file depends on.
Three Ways In, Depending on Where the Departure Stands
If the person is still walking out the door, this service preserves the record first. If the departure already happened and you need a first answer at a known cost, a flat rate Core Analysis gives you one. If information has clearly moved and litigation is coming, the wider trade secret examination follows it into the receiving accounts and devices. The three connect as the matter develops, and the free consultation settles which one fits.
Open a wider trade secret matter
Carry the evidence into a broader dispute with discovery support, additional sources and expert testimony where the matter needs them.
The Examiners Behind a Contested Departure
Global Digital Forensics has operated since 1992. Our national practice most often serves Fortune 1000 companies and AmLaw 100 firms, and it serves just as readily the small and midsize businesses that feel one departing salesperson most sharply. Veronica Perez, an EnCase Certified Examiner, has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago, with casework that includes trade secret and employee disputes. Robert Knudsen, a Certified Computer Examiner, brings eighteen years of forensic experience and twenty years of New York City Police Department service to the custody record a contested departure demands.
The examiner who preserves your evidence is the examiner who explains it, to your general counsel this month and to a court if the matter gets there. We read Microsoft 365, Google Workspace and GitHub records against the vendors' own definitions in Microsoft Purview audit log activities, Google Workspace Drive log events and the GitHub audit log for an enterprise, so the timeline holds when someone asks what an audit event actually means.
Run Offboarding and Preservation on One Plan
The day an employee gives notice, three clocks start: the access that must be cut, the laptop IT wants back in rotation and the audit logs that expire on their own schedule. We agree an offboarding action log with your legal and IT teams, so disabling accounts, removing licenses, wiping devices and changing retention never quietly undercut the evidence plan, and we record every hold, export and audit period as it happens. When you need a defined first answer at a known price, ask about Employee Exit Core Analysis, which covers the agreed sources at a flat rate.
If the laptop is due back this week, call (800) 868-8189 before IT reimages it and we will walk through the offboarding action log with you.
The engagement
Following Files Through USB, Personal Cloud and Email
Company information leaves in familiar ways: a USB drive connected the evening before the resignation, a shared folder downloaded in bulk, a customer list attached to a message bound for a personal account, a synchronization client pointed at personal cloud storage, or a repository cloned to a machine the company never issued. Each of those acts leaves a different kind of record, and no single one of them tells the whole story.
We begin with a preservation plan IT can carry out. It names the laptops, phones, virtual desktops, mailboxes, cloud drives, repositories, backups and security logs that matter, and it gives HR and security a short checklist instead of a general instruction to keep everything. Counsel sets scope and privilege, and we document the sources and carry out the approved protocol.
Then we read the evidence together. File system, shortcut and recent item records, USB connection histories, browser and application histories, mailbox and cloud audit logs, chat exports and AI assistant records each show a different part of the same act. A USB connection record places a device on the machine at a time; tying a specific file to that device takes the shortcut, jump list and file system records around it. Job duties, workflows, timing and file sensitivity all enter the analysis, which is why our findings survive the first question from the other side about the backup software.
The result is a timeline in which every entry links to its source record and every inference is labeled as one. The findings support a demand letter, an injunction application or a decision to let the matter rest, with declarations and exhibits where the matter needs them.
Scope
What to hold and what to leave untouched
Immediate steps that reduce access are separated from the later imaging and exports that keep history, so security and evidence stop working against each other.
Computers and virtual desktops
We image supported laptops, desktops and virtual desktops with hash verification and custody documentation and preserve the deletion, USB, browser and application artifacts the analysis will depend on.
Mailboxes and cloud accounts
We preserve authorized Microsoft 365 or Google Workspace mailbox, drive and audit sources, including login history, inbox rules, delegation, forwarding and OAuth grants, before offboarding changes them.
Removable media and personal cloud
USB and copying records, personal cloud synchronization and personal email artifacts are weighed against job duties, workflows and policy. Access to a personal account itself proceeds under separately confirmed authority.
Source code and repositories
Commits, access configuration and retained provider audit events are compared. What pulls, clones and pushes show depends on the provider, plan and audit retention, so we confirm those settings first.
Reports, declarations and exhibits
Findings tied to their sources, the further records that would close any gap, and declarations and exhibits where the matter calls for them.
Methodology
Four Steps From Resignation to Findings
Coordinate offboarding and preservation
IT and security get a plan that separates immediate access changes from the imaging and exports that keep history, so the exit proceeds and the evidence survives.
Preserve devices, accounts and logs within their retention
Each workload gets its authorized hold or export path. A mailbox hold leaves sharing and application audit events behind, so we collect those logs separately before their retention runs out.
Analyze file movement and account activity in context
USB, copying, personal cloud, forwarding, repository, deletion and sign in activity are examined together and weighed against job duties, workflows and timing.
Explain the findings
Each finding names its source, each inference is labeled, and the report lists the additional records that would answer any open question.
Our departed employee data gathering package lists the devices, mailboxes and logs we will ask about on the first call.
Evidence commonly examined
Departure Evidence We Examine
The company laptops, desktops, phones and virtual desktops the employee used come first, with the mailbox, drive and cloud audit records that hold both content and account activity. Around them sit the USB history and copying artifacts, personal cloud synchronization and browser artifacts within the authorized scope, the repository, ticketing and administrative logs, and the badge, VPN and identity records that confirm access and timing for the period.
What you can expect
A senior examiner can walk through the facts of your matter on a free call.
What the Departure Review Delivers
Your IT and security team receives a preservation checklist with source and action priorities for the exit. The timeline sets recorded access, copying, deletion and transfers against their source records, declarations and exhibits support the legal use of the record, and our recommendations name the records that further production or a subpoena could add.
Flat Rate Core Analysis for a First Answer
GDF Core Analysis is a flat rate forensic service for an agreed scope. We preserve the relevant computer, email and cloud records, analyze the activity around the departure and deliver a plain language report and timeline, with the sources, the period and the questions fixed in writing before work begins.
Employee Exit Core Analysis fits the ordinary resignation, where a manager needs to know whether customer files or pricing left with the employee. Executive Departure Core Analysis handles departures that reach the board, where delegated access, privileged material and deal sensitivity shape the work. Business Partner Separation Core Analysis examines the shared accounts and company records partners fight over when they part ways.
Gather records before an engagement
Gather the Departure Records Before the First Conversation
Use the guide to identify the devices, mailboxes, cloud storage, archives, backups and logs that matter in a departure, assign an owner to each and prepare the questions you will bring to counsel, IT and the examiner.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Primary Data Sources in Employee Departure Matters
Identify the devices, mail, cloud storage, archives, backups and logs to discuss with counsel and your IT team before anything is reissued.
File: ZIP: source guide, checklists and sample questions.
Frequently asked
When an Employee Leaves With Data: First Questions
Is a USB copying record alone proof of misconduct?
On its own, a connection record shows that a device was attached and when. We compare it with shortcut, file system and cloud records, job duties, workflows, timing and file sensitivity before drawing any inference, and the report shows exactly which records support each step.
Can you preserve a laptop before the employee is notified?
Yes, when counsel confirms it is legally supported. Preserving before notification reduces the risk that a departing custodian alters the record once they know an examination is coming, and we coordinate the timing with your legal, HR and IT teams.
What if the employee used a personal cloud account?
Synchronization artifacts, browser records and file activity on the company devices can show that personal cloud services were used and often which files were involved. Access to the personal account itself takes additional legal steps that counsel directs, and we tell you on the first call what the company devices can show on their own.
Free consultation
Protect the Records Around an Employee Exit
On the first call a senior examiner asks who is leaving, what they could reach and when the devices come back, then tells you what to hold today and how the examination and report will run.
Call the 24/7 hotline when the laptop is due back sooner.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .