An employee or ex-employee incident can result in either loss of intellectual property from your company and loss of face of an employee and even a whole department. That is why it is essential to act swiftly to preserve the volatile data by imaging the laptop, server or phone involved in the case.  The examination can be done remotely, or you can have a computer forensic expert to go onsite and do this. In general, if the computer is switched on leave it turned on, but not connected to a network as the culprit may be able to manipulate remotely.

Typically we are instructed due to a currently suspected theft of data by an employee or the investigation of a device after the suspect has started trading as a new company or as an agent of another firm.

Once a forensic image is secured the expert would proceed with triaging to see if there is any low hanging fruit on the forensic image such as items on the desktop, Windows recycle bin or downloads folders for example.

Deleted LinkedIn conversations, cloud uploaded data, emails and 100s of other artefacts would typically be carved from the file to ascertain communications of the suspect.

When provided with keywords and a timeline the data can be filtered as to remove as much of the non-relevant files and make the review a breeze.

Internet history form browsers such as Edge and Chrome can be scanned using software and techniques. No browsing is safe even with features such as InPrivate and Incognito mode enabled.

Often data is exited out of a machine using Dropbox, Google Drive, private email or USB. This data can all be recovered and exported out as CSV spreadsheet’s to produce a timeline of user actions.

The results of an investigation can be outputted as a court admissible clear English PDF document with videos and illustrations if necessary.

Compute Forensics Ltd have been involved in private employment disputes, tribunals, contractual disputes and other issues. Compute can aid in a wide range of Computer Forensic related issues.