Preserve an employee departure
Coordinate preservation with offboarding so the laptop, the mailbox and the cloud account are captured before IT reissues or deletes them.
Trade Secrets, Departing Employees and Data Theft Evidence
Trade Secret and Employee Data Theft Forensics
An employee resigns, the laptop comes back wiped and a competitor suddenly knows your pricing. Global Digital Forensics preserves the computers, email and cloud accounts of departing employees, executives and business partners, traces where the information went and puts the findings in a report counsel can take to court.
Discuss your case
Find Out Whether a Departing Employee Took Company Information
Tell us who left, what they had access to and what has you concerned. A senior examiner will tell you which laptops, mailboxes and cloud accounts to lock down today and what an examination can show about copying, sending and deletion.
The matter
The information, people and period that need examining, so preservation starts with the right laptops, mailboxes and cloud accounts rather than everything the company owns.
The output
A source linked account of every observed transfer, access or deletion, with the records behind each event, written so attorneys and executives can act on it.
The scope
A flat rate Core Analysis for a first look, or a wider examination with discovery support and expert testimony. The scope grows only when the evidence justifies it.
Preserve First or Start With a Flat Rate Look
Most matters start in one of two places. If the person is still walking out the door, preserve first and ask questions once the record is safe. If the departure already happened and you need an answer, a focused Core Analysis gives you one at a flat rate, and either path feeds the full trade secret examination on this page when information has moved.
Scope an initial Core Analysis
Agree a focused first examination at a flat rate, with the question it will answer and the sources it will cover set out before work begins.
Court Tested Examiners for Data Theft Disputes
Global Digital Forensics has operated since 1992, and our national technology practice most often serves Fortune 1000 companies and AmLaw 100 firms alongside the small and midsize businesses that feel a data theft most sharply. Our examiners hold the CISSP, EnCE, CCE and CHFI among their credentials and have testified in federal and state courts. Veronica Perez's casework includes intellectual property theft, trade secret and employee disputes, and she has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago.
We also know how these cases turn on the evidence. An employee who emails a customer database to a personal account and deletes the message believes the trail is gone. In a worldwide intellectual property case, two employees and a manager of a chemical manufacturer with facilities in New York, New Jersey, Texas, China and Argentina did exactly that with a customer contact database, invoicing information and financial data, and both they and the receiving company denied it. GDF recovered the original emails from the forensically examined desktops, extracted matching records from the receiving mail servers, several sets of backup tapes and the database itself, and correlated the dates, times and messages into a record that supported counsel's assessment of the transfer and of what the receiving company knew.
Our process follows NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, and the examiner who performs the work explains it to you and, when the matter requires it, to the court.
Reports Built for the Courtroom and the Boardroom
A departure examination has two readers: the litigator who needs every finding tied to a record that survives cross examination, and the executive who must decide by Friday whether to send a demand letter, seek an injunction or let the matter go. Robert Knudsen's hundreds of computer and mobile device examinations in federal and state court matters and his twenty years of NYPD documentation shape how GDF writes for both. Each finding names its source and separates an account event from an action the records tie to a person.
A Flat Rate First Answer Through Core Analysis
Core Analysis is a flat rate forensic service for an agreed departure scope. We preserve the relevant email, documents and computer evidence, analyze the activity around the departure and deliver a plain language report and timeline that tells you whether there is a problem worth pursuing, at a price agreed before work starts.
Choose employee exit Core Analysis, executive departure Core Analysis or business partner separation Core Analysis. Each is built for the records and business questions that kind of departure raises, and each gives decision makers an understandable starting account of the evidence.
When the first look shows that information moved, a broader trade secret examination follows the transfer paths into additional accounts, destination devices and the receiving company's records, and prepares the detailed exhibits and expert opinions the dispute will need.
Four Stages That Trace Company Information
Every departure examination runs through four stages, and each one guards against a specific way these cases go wrong: evidence overwritten before anyone looked, a USB record mistaken for proof of copying, a timeline that collapses under cross examination, or findings that never reach the discovery requests that would have won the matter.
01 / Lock Down the Laptop, Mailbox and Cloud Account
The most damaging mistake in a departure matter happens in the first week, when IT reissues the laptop, deletes the mailbox after thirty days or lets the cloud account's audit log age out. We move first on whatever ordinary business activity will change soonest. We acquire verified forensic images of computers and phones, authorized exports of Microsoft 365 and Google Workspace mailboxes and cloud storage, and the retained logs of the accounts in scope, each with hash values and a custody record from the first minute. Remote collection of email and cloud accounts means a departing employee in another state or country does not delay preservation.
We coordinate the preservation plan with HR, counsel and IT so offboarding continues without destroying the record, and we identify the date ranges, custodians and sources that matter before anyone spends money collecting the rest.
If the laptop is due back at IT this week, call (800) 868-8189 before it is reissued and we will tell you what to hold.
02 / Follow Files Through USB, Personal Email and Cloud
Information leaves through a handful of channels: a USB drive the night before a resignation, a bulk download from a shared folder, a customer list attached to a message to a personal address, a sync client pointed at personal cloud storage, a chat thread that plans the handoff. We read every channel's records together and follow the information you identify, whether customer lists, pricing, source code, designs or business plans, through file versions, timestamps, account identifiers and communications into one supported sequence.
A USB connection record puts a device on the machine; proving which files went onto it takes the records around it. Where the destination device, the cloud account or the receiving mailbox can be obtained, we compare the records on both ends, which is how matching records on the receiving mail servers in the worldwide intellectual property case supported the assessment of a transfer the other side had denied.
03 / Separate Deliberate Copying From Routine Activity
Synchronization clients, backup software and ordinary work generate thousands of file events that look alarming out of context. We put the laptop, the mailbox, the cloud account and the phone on one timeline, test each suspicious event against the competing explanations and separate an account event from an action we can attribute to a person. Every entry links to its source record, so you see the strength of the case before the other side does.
Where the evidence sits in Microsoft 365, Google Workspace or another cloud application, the source specific services explain what each platform retains, for how long and what an authorized export can recover.
04 / Carry the Findings Into Discovery and Testimony
An examination is only useful if it reaches the decision. We deliver a short early findings memorandum when you need to decide quickly, then a detailed transfer timeline, file comparisons, relevant communications and demonstrative exhibits as the matter proceeds. We help counsel draft discovery requests and deposition questions aimed at the records the other side holds, as in the worldwide intellectual property case, and our eDiscovery collection and processing organizes the collected material for review and production.
Our expert witnesses prepare reports, declarations and deposition and trial testimony on trade secret misappropriation, confidentiality disputes and alleged breaches of fiduciary duty, and the examiner who did the work is the one who explains it.
To put a senior examiner on this part of the matter, request a free consultation.
We Work Where Your People and Devices Are
Tell us where the people and devices are located, who administers the accounts and which deadlines affect preservation. GDF operates from sixteen offices across the United States with national and international reach, and we coordinate the evidence plan across offices, remote workers and outside counsel.
Evidence We Examine in a Departure Matter
The authorized accounts, files and messages within scope come first: the laptop and phone the employee used, the mailbox, the cloud storage and the collaboration accounts. Around them sit the activity logs and supporting device records that show when a USB drive was connected, when a folder was downloaded and when a message was sent or deleted, and the collection and chain of custody documentation that lets anyone who needs to check the evidence confirm how it was handled.
What You Receive
You receive an evidence inventory and documented findings that name the source of every observation, activity timelines and exhibits that tie each transfer, access or deletion to its record, and review ready material for the legal team. Reports are written for executives and the court, with expert support through discovery, deposition and trial.
If this matches the evidence in your case, tell us what you have and we will map the next steps on the first call.
Gather records before an engagement
Preparation Guides for a Departing Employee Matter
These packs help you identify the records, assign owners and prepare questions before you speak with counsel, your IT team or an examiner.
Read every guide freely. Choose a download, then share your work email and company or skip. Your selected file starts immediately.
Departed employee data sources
Identify the devices, mailboxes, cloud storage, archives, backups and logs to discuss with counsel and your IT team before anything is reissued.
File: ZIP with the source guide, checklists and sample questions.
Key Data Sources in Commercial and Contract Litigation
Locate contracts, messages, collaboration records and business system data, with questions for counsel and system owners.
File: ZIP with the source guide, checklists and sample questions.
Frequently asked
USB Drives, Personal Email and Departing Executives
Can you show whether an employee emailed company information to a personal account?
Yes. We examine the messages, attachments, forwarding rules, account activity and the related computer and cloud records to trace where company information went, and where the receiving mailbox or server can be obtained we match the records on both ends. Deleted messages are often recoverable from the workstation, the server or backups, which is how the original emails surfaced in the worldwide intellectual property case.
Can you determine whether company files were copied to a USB drive?
USB connection history shows that a device was connected and when. We add the file system, shortcut, application and destination records to show which files moved, and the report states exactly what each record supports.
How is Core Analysis different from a full trade secret examination?
Core Analysis preserves the agreed sources and delivers an activity timeline and a plain language report at a flat rate for a defined scope. A full trade secret examination follows the transfer paths into additional accounts and devices, answers further technical questions and adds detailed reporting, discovery support and expert testimony.
Can you examine a departing executive or a former business partner?
Yes. GDF offers distinct Core Analysis services for executive departures and business partner separations, with collection and examination built around the authorized records and the business questions each kind of departure raises.
Can you work directly with our attorney?
Yes, and most matters run that way. We coordinate scope, evidence handling, deadlines and deliverables with your attorneys and the authorized business contacts, and we help them draft discovery requests and deposition questions aimed at the records the other side holds.
Can collection include remote workers?
Yes. We collect email and cloud accounts remotely and plan the right process for the computers and phones of employees in other offices, states or countries. Tell us where the devices and account administrators are and we will plan preservation around them.
Expert Testimony When the Dispute Goes to Court
When the evidence requires a technical opinion, our Data Exfiltration Expert Witness service prepares the reports, declarations and testimony that explain how the information moved and what the records establish.
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .