Executive Departure Core Analysis
Executive Departure Forensics for Boards and General Counsel
A chief revenue officer leaves for a competitor, the acquisition model was in that mailbox and the board wants answers this week. GDF Core Analysis preserves the executive's computer, business email, delegated mailboxes and cloud records and reconstructs what happened to board material, forecasts and customer information. The scope and flat rate are agreed in writing, and directors receive a report they can read without an interpreter.
Settle Privilege and Delegated Access Before Collection
An executive departure is not an ordinary offboarding. The departing officer may have had an assistant with full mailbox delegation, a board seat whose material is privileged, and access to deal rooms, forecasts and compensation data the rest of the company never sees. Before collection we identify the board and strategic records, the delegated assistants, the shared mailboxes and the privileged material, and counsel directs how privilege is segregated.
The written scope names the custodians, delegated accounts, board or strategic records and the departure period, with volume limits, privilege handling and the flat rate deliverable. Broader tracing, restoration of deleted material, additional assistants' accounts and testimony are scoped separately, so the board knows the cost of the first answer before it asks.
An event recorded under the executive's account may reflect the assistant, a delegation or shared access. The report separates the account event from the action we can attribute to the executive personally and names any source that would sharpen the attribution, so the company holds a technical record built for the day the other side's expert reads it.
Every audit entry in the timeline is read against the platform's own published definitions, Microsoft Purview audit log activities and Google Workspace Drive log events.
Get a free consultation with the role, the dates and the systems involved, and we will draft a scope the board can approve before collection starts.
The Examiners Who Brief the Board
Global Digital Forensics has operated since 1992, and our national practice most often serves Fortune 1000 companies and AmLaw 100 firms, where an executive departure carries deal, disclosure and governance consequences. Joseph Caruso, our founder, CEO and CTO, began his technology career in 1980 and works on disputes over databases, digital evidence and complex business systems. Robert Knudsen, a CISSP and Certified Computer Examiner, brings hundreds of computer and mobile device examinations for federal and state court matters and twenty years of New York City Police Department documentation discipline. The examiner who does the work is the examiner who briefs the board.
The engagement
What Core Analysis Examines When an Executive Leaves
Executives hold the information that moves markets and deals: board packs, financial forecasts, customer strategy, acquisition plans, compensation and the private conversations around all of them, spread across a laptop, two mailboxes, a cloud drive and whatever messaging the leadership team preferred. A departure, especially one to a competitor or in the middle of a transaction, raises questions that a single system cannot answer.
We preserve the agreed computer, email and documents first, with hash verification and custody documentation, because an executive's laptop is often wiped for a successor within days and a delegated mailbox gets reassigned without anyone treating it as evidence.
Then we compare file activity with communications, cloud storage and retained AI records, tying each message to the file events and the dates that matter: notice, the last board meeting and the final day of access. The board and management see the supported sequence and decide what deserves further analysis.
Core Analysis uses documented forensic methods at a flat rate for the agreed examination, and the proposal fits the sources, dates, authorized contacts and reporting to the executive's role.
Scope
Map executive access
We map the devices, business email, shared repositories and records attached to the role with the authorized representatives, including delegated access and the assistants who held it.
Preserve strategic records
We preserve the included systems, documents and communications with handling records while leadership manages the transition and the successor takes over.
Review communications and sharing
We compare email, attachments, chats and retained sharing records, connecting participants, dates and documents to the departure questions.
Examine cloud and AI activity
We correlate available OneDrive, Google Workspace, Box, Dropbox and AI records with the computer and message evidence.
Reconstruct the sequence
We build the chronology around the decisions, notice and departure dates that matter, explaining supported access, copying, transfer and deletion with their sources.
A report written for directors
The concise report gives directors the technical account in plain language, with the records counsel needs to assess confidentiality, trade secret and fiduciary concerns.
Methodology
From the Board's Question to a Signed Report
Segregate privilege before collection
How board and privileged material is segregated is set by the legal team, and the custodians, delegated mailboxes, dates and flat rate are recorded in writing.
Preserve the executive and delegate accounts
The executive's computer, mailbox and cloud storage are preserved together with the delegated and assistant accounts that touched them.
Attribute each event to a person
Every account event is tested against delegate and assistant access before it is attributed to the executive personally.
Brief the board
Directors receive the findings in a briefing written for the board, with the technical record behind it.
Our guide How a Forensic Examination Reaches the Witness Stand shows what each stage produces and when leadership sees it.
Evidence commonly examined
Executive Records We Examine
The executive's computer, the primary mailbox and every delegated or shared mailbox come first, with the assistants' access recorded alongside. Board portals, deal rooms and cloud storage the role could reach add the strategic record, and messaging and AI tool records in scope show how material was discussed and shared.
What you can expect
Your Executive Activity Timeline and Report
Preservation and handling documentation identifies every source retained. The timeline ties decisions and activity to the recorded events, the concise report explains the technical findings for directors, and a results discussion helps the general counsel identify the next evidence or expert need.
Gather records before an engagement
Prepare the Executive Departure Evidence Before Access Changes
The departure guide helps the legal team and IT identify the devices, business accounts, delegated mailboxes, archives and logs attached to an executive role before access changes, and record who owns each source and which questions the first examination must answer.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Primary Data Sources in Employee Departure Matters
Identify the devices, mail, cloud storage, archives, backups and logs to discuss with legal and IT before executive access is changed.
File: ZIP: source guide, checklists and sample questions.
Browse all preparation packages by subject.
If access is about to change and the source list is still incomplete, call (800) 868-8189 before the laptop is reissued or the mailbox is reassigned.
Frequently asked
First Questions After an Executive Leaves
An executive is leaving. Can GDF determine what happened to company information?
Core Analysis is built for that question. It preserves the agreed computer and business account evidence and builds a timeline around the board material, forecasts, deal information or other company information at issue, explained in plain language for directors.
Is Executive Departure Core Analysis offered at a flat rate?
It is. The custodians, sources, dates, questions, privilege handling and the initial report are agreed in writing before the flat rate examination begins, and anything beyond that scope is agreed separately.
Can you examine activity across several business systems?
Across all of them. The scope correlates computer, email, chat, cloud and AI records tied to the executive role, and personal attribution rests on the supporting evidence, never on the account name alone.
Can this help counsel assess a fiduciary duty concern?
It gives counsel the facts to apply the duties to. The examination documents the communications, information use and transfers around the departure in a technical record that holds when the other side tests it.
Who is the report written for?
The report is written for directors, business leaders and their lawyers. It explains the relevant events and the supporting records in language a board can act on, with the technical detail available behind it.
Can you provide expert support after the analysis?
When the matter proceeds, GDF prepares reports, affidavits and deposition and trial testimony through a further expert engagement, and the examiner who did the work is the one who testifies.
Free consultation
Know What Happened to the Forecasts Before the Board Asks
On the first call a senior examiner takes the executive's role, the departure dates, the strategic information and who shared access, then proposes the sources, privilege handling and flat rate for the first report.
Briefings written for directors, with a 24/7 hotline behind them.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .