Employment, trade secrets, insider risk
Departing Employee Forensic Analysis
Preserve the record before offboarding rewrites it. Account suspension, device reissue, remote wipe, and retention timers can erase the history needed to assess copying, deletion, or unauthorized access.
Preserve records during offboarding
Agree the offboarding action log with IT and counsel so disabling accounts, removing licenses, wiping devices or changing retention does not silently alter the evidence plan. Record separate holds, exports, audit periods and unavailable sources.
This service coordinates preservation and traces information across the agreed sources. Core Analysis is the bounded initial report; additional repositories, personal accounts with valid authority, deeper tracing or expert opinions require a separate agreed scope.
Primary references: Microsoft audit activity definitions (opens in a new tab) · Google Drive log events (opens in a new tab) · GitHub enterprise audit events (opens in a new tab).
Preserve the record during offboarding
Coordinate collection with account changes and the return of company equipment. GDF helps the employer and counsel identify email, computers, cloud files and messages to preserve. For a defined initial activity report, ask about our flat-rate Employee Exit Core Analysis.
The engagement
A preservation hold that IT can execute
Departures create two competing pressures: secure the environment quickly and retain the technical record. GDF coordinates with counsel and IT to preserve relevant devices, accounts, file repositories, access events, email, collaboration data, and removable-media history before ordinary offboarding changes the source.
The plan identifies laptops, phones, virtual desktops, mailboxes, cloud drives, shared repositories, development platforms, backup sources, and security logs. It distinguishes actions that should happen immediately from actions that can wait for imaging or export. The objective is to reduce ongoing access without destroying useful historical data.
Counsel defines legal scope and privilege. GDF documents technical sources and implements the approved protocol. Human resources and security teams receive a concise preservation checklist rather than a generic instruction to save everything.
Scope
Rapid preservation checklist
A concrete list of immediate and near-term actions for IT and security teams. Immediate items reduce ongoing access; near-term items preserve historical data through imaging or export.
Endpoint acquisition
Forensic imaging of laptops, desktops, and virtual desktops. Chain of custody documented. Deletion, USB, browser, and installed application artifacts preserved for later analysis.
Cloud account and mailbox preservation
Microsoft 365 or Google Workspace mailbox, drive, and audit data preserved. Sign-in history, inbox rules, delegate configurations, forwarding, and OAuth grants captured before change.
Removable media and personal cloud
USB device and file-copy activity, personal cloud synchronization, and personal email use analyzed against job duties, workflow, and available policy.
Source code and repository activity
Repository examination compares available commits, access configuration and retained provider audit events. Pull, clone and push visibility depends on provider, plan, audit settings, delivery method and retention; absence of a logged event does not establish absence of activity.
Reporting and declaration support
Findings prepared for counsel: what happened, source supporting each fact, limits of attribution, and additional sources that could resolve gaps. Declarations and exhibits available as needed.
Methodology
How the analysis runs
-
Freeze
The preservation plan is issued to IT and security. Immediate items reduce ongoing access; near-term items preserve historical data through imaging or export.
-
Preserve
Identify each workload and authorized hold or export path. A mailbox or document hold does not preserve every account, sharing or application audit event; separately collect available logs within their actual retention and record gaps.
-
Analyze
USB, file-copy, personal cloud, email forwarding, code repository, deletion, and authentication activity is examined in context. Job duties, workflow, and timing are considered before drawing inferences.
-
Report
Findings identify what happened, the source supporting each fact, and the limits of attribution. Where a next source could resolve a gap, it is identified.
Evidence commonly examined
Evidence reviewed
- Company-issued laptops, desktops, phones, and virtual desktops
- Mailbox, drive, and cloud audit records
- USB device history and file-copy artifacts
- Personal cloud synchronization and browser artifacts where in scope
- Repository, ticketing, and administrative audit logs
- Badge, VPN, and identity records for the relevant period
What you can expect
What you receive
- Preservation checklist tailored to the client's environment
- File-access, copy, deletion, and transfer timeline
- Sourced findings that separate observation from inference
- Declaration and exhibit support for counsel
- Next-source recommendations for gaps a subpoena could fill
Frequently asked
Common questions
Is USB copying alone proof of misconduct?
No. USB connections and file-copy artifacts are relevant, but analysts compare them with job duties, workflow, timing, file sensitivity, and corroborating records. A single technical event is not treated as intent.
Can you preserve a laptop before the employee is notified?
Coordination with counsel, HR, and IT determines when preservation occurs. Where legally supported, preservation can happen before notification to reduce the risk that a departing custodian alters the record.
What if the personal cloud account was used?
Where in scope and legally supported, synchronization artifacts, browser records, and file activity can indicate use of personal cloud services. Direct access to a personal account requires additional legal steps.
Talk with an examiner
Discuss your matter and next step
Tell us the systems, evidence and deadline. We can review relevant experience, potential conflicts and the scope before engagement.
Since 1992 · 24/7 dispatch · Court-tested experts
Talk with an examiner
Discuss the matter and the next step.
Tell us what happened and what you need to find out. Speak with a GDF expert about how we can help.
24/7 hotline: 1-800-868-8189
GDF Core Analysis: departures and business separations
A flat-rate forensic examination for the agreed scope, with evidence preservation and an activity timeline that business leaders and counsel can understand.
- Employee Exit Core Analysis: Did an employee take proprietary information? GDF Core Analysis preserves evidence and explains computer, email, cloud and AI activity at a flat rate.
- Executive Departure Core Analysis: GDF Core Analysis examines executive computer, email, cloud and AI activity. Flat-rate forensic preservation and clear reporting for leadership.
- Business Partner Separation Core Analysis: GDF Core Analysis preserves records when business partners separate. Flat-rate forensic examination of email, files, cloud storage and AI activity.