Preserve an employee departure
Coordinate the laptop, mailbox and cloud account with offboarding so routine account changes do not erase the record.
Employee Exit Core Analysis, Flat Rate Scope and Plain Language Reports
Flat Rate Forensic Analysis of an Employee's Final Weeks
Your sales manager gave two weeks' notice and the pipeline report was downloaded the same afternoon. GDF Core Analysis preserves the employee's computer, business email and cloud records, examines what happened to the information you name and delivers a plain language report you can act on. The scope and the flat rate are fixed in writing before anything is collected.
Defined scope, defined cost
Agree on the Question, the Sources and the Price First
On the day an employee leaves, most employers need one focused answer. They need to know whether a specific set of files or customers went out the door, and they need to know the cost before they ask. Core Analysis fixes the question, the authorized sources, the period and the report in writing, and the flat rate covers exactly that agreement.
The information you name
Customer lists, pricing, designs or source code: we examine how the material you identify was handled before and around the exit.
The computer and accounts in scope
The written scope names the assigned computer, the business email and cloud accounts and the analysis included, so every source examined is one you authorized.
Findings that set the next step
The report shows whether the records reveal copying, sending or deletion worth pursuing, so counsel can choose a demand letter, a wider examination or a closed file.
Where Core Analysis Fits Among Our Employee Services
Core Analysis is the first step when the employee has already left or is about to, and you want a defined answer at a defined cost. If the person is still in the building and the laptop has not come back, preservation during offboarding comes first. If the first look shows information moved and a dispute is forming, the wider trade secret examination adds sources, discovery support and expert testimony.
Open a wider trade secret matter
Add sources, destination devices, discovery support and expert testimony through an agreed expansion when the evidence justifies it.
A Written Scope Makes the Flat Rate Real
For an employee exit we identify the assigned company computer, the business accounts, the relevant period and the specific information at issue. We also ask early about AI use, because what an employee pasted into or asked of an AI tool may survive in browser, application, proxy or account records, and the sooner those are preserved the more of them remain.
The written scope states which computer, which business accounts, which dates and which files the flat rate covers, along with volume limits and the form of the timeline or findings memorandum. Additional devices, personal accounts, tracing into destination systems and testimony are agreed separately, so the invoice matches the scope you approved.
The departure timeline keeps recorded downloads, attachments, copying and deletions apart from what they might mean, and it accounts for shared access and ordinary offboarding activity before attributing an act to the employee. The result is a record that holds when the other side reads it.
Experienced Examiners on Every Employee Exit
Global Digital Forensics has operated since 1992 and serves Fortune 1000 companies, AmLaw 100 firms and the small and midsize businesses for whom one departing employee is a serious event. Our examiners have testified in federal and state courts and hold credentials including the CISSP, EnCE, CCE and CHFI. Robert Knudsen has conducted hundreds of computer and mobile device examinations for federal and state court matters, and Veronica Perez's casework includes trade secret and employee disputes. The examiner who performs your Core Analysis is the examiner who explains it.
If the findings may have to be defended in court, our digital forensics expert witness service carries Core Analysis findings into declarations and testimony.
If this matches the evidence in your case, tell us what you have and we will map the next steps on the first call.
The engagement
What Core Analysis Examines in the Final Weeks
A resignation leaves a business with specific worries: the customer list, the pricing model, the designs, the source code, the proposal that was due next month. Core Analysis gives owners, HR teams and counsel a documented account of what happened to that material on the former employee’s computer and business accounts, written for people who have never read a forensic report.
We preserve first, because the computer is about to be reassigned and the account about to be disabled, and a record that is gone cannot be analyzed at any price. The agreed computer, email and documents are preserved with hash verification and custody documentation, so the source context survives into the analysis and, if needed, into a courtroom.
Then we read everything together. Email, chats, cloud storage, file activity and retained AI records are compared side by side so a download can be evaluated beside the message sent a minute later or the upload that followed it. A file copied to a USB drive means one thing next to a message to a competitor and another next to a routine backup, and the surrounding records usually tell us which.
The report is short, written in plain language and built on documented forensic methods. You know what the work will cost and what you will receive before collection starts.
Scope
Preserve the computer and business records
The approved computer, email and documents are preserved before reassignment or account changes remove useful records, with handling documentation that keeps the source context intact.
Trace the information you named
Files, transfer records, attachments, USB use and cloud activity are compared to show how the confidential information you identified was handled.
Review email and chats
We examine messages, attachments, participants and dates in the authorized accounts and connect the communications to the relevant files on the timeline.
Examine cloud storage and AI use
We assess available OneDrive, Google Workspace, Box, Dropbox and relevant AI records for uploads, sharing and related account activity in the agreed period.
Build the departure timeline
A chronology of the agreed period around the exit that places copying, sending, deletion and account activity in the context of the business question.
Explain the findings clearly
A concise report naming the events, the dates and the records behind each one.
Methodology
From Business Question to Plain Language Report
Fix the final weeks in scope
We agree the exit date, the weeks before it, the information at issue and the flat rate in writing before anything is collected.
Preserve the computer and cloud sync
The assigned computer, the business mailbox and the synced cloud folders are preserved with hash values before the machine is reassigned.
Read the final weeks activity
File opens, copies, attachments, uploads and deletions from the final weeks go on one timeline beside the messages around them.
Deliver the plain report
A short report in plain language tells management and counsel what the records show and whether the matter warrants more work.
If the laptop is due back or the account is scheduled to be disabled this week, call (800) 868-8189 and we will start with preservation while the rest of the scope is agreed.
Evidence commonly examined
Employee Records We Examine
We start with the assigned computer and its file activity for the weeks before the exit, then add the business mailbox, attachments and chats around each event. Synced OneDrive, Google Workspace, Box or Dropbox folders and any AI tool records in scope show where files went after they left the laptop.
What you can expect
Your Findings and Activity Timeline
Preservation and handling records document what was retained. The timeline ties each relevant event to its source, the report is written for business readers without a technical background, and a findings discussion helps you judge whether the next step needs a wider scope.
Gather records before an engagement
Describe the devices and the deadline and the first call sets the plan.
Prepare the Employee Evidence Sources for the Scoping Call
Before the first conversation, identify the devices, business mail, cloud records, archives and logs that touch the departing employee and note who controls each one. The guide helps your lawyers and IT organize those source questions so the scope can be agreed quickly.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Primary Data Sources in Employee Departure Matters
Identify the devices, mail, cloud storage, archives, backups and logs to discuss with your attorney and IT before the computer is reassigned.
File: ZIP: source guide, checklists and sample questions.
Frequently asked
Flat Rate Scope, AI Use and Trade Secret Support
An employee left and we need to know whether they took proprietary information. Can GDF help?
That is the question Core Analysis answers. It preserves the agreed computer, email and documents, examines the activity around the exit and delivers a timeline and plain language report at a flat rate for the defined scope.
Is Employee Exit Core Analysis a flat rate service?
It is. We agree on the devices, accounts, period, questions and the included report before the examination begins, and the flat rate covers that scope. Work outside it is agreed separately.
Can you examine email, chats, cloud storage and AI use?
All of them, within the authorized scope: email, chats, retained AI activity and OneDrive, Google Workspace, Box and Dropbox sources, so the timeline covers every place the information lived.
Will a manager without technical training understand the report?
That is who it is written for. The report sets out the relevant events in plain language with a timeline and the supporting records, so management, HR and counsel see exactly what the examination found.
Can the analysis support a trade secret matter?
It gives counsel the technical record to start from. Core Analysis documents the activity involving proprietary files and communications, and a wider examination and expert testimony follow through an agreed expansion when the matter needs them.
What should we do with the employee’s computer right now?
Set it aside exactly as it is, leave the business accounts in place and call us, so the examiner sees both in their current state. We coordinate preservation with the business and its authorized representatives before anything changes.
Free consultation
Find Out How Information Moved Before the Exit
On the first call a senior examiner takes the exit date, the information you are worried about and the assigned devices and accounts, then proposes the written scope and flat rate for the first examination.
Scope and price fixed in writing before collection.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .