Overview
A departing employee has downloaded an unusual volume of files. A manager finds a forwarding rule. A confidential document appears outside the organization. Each event may justify a closer look, but none should be treated as a complete explanation of what happened.
The immediate challenge is to protect the business while preserving the information needed for a fair investigation. Routine offboarding can complicate that work if a laptop is wiped, an account is deleted, or relevant logs expire before anyone assesses them. Bring the people responsible for security, IT, HR, and legal decisions together early so preservation and access restrictions can be coordinated.
Do not delay urgent containment simply to keep a system untouched. If access must be revoked or a device isolated to prevent further harm, act through the authorized response team and document the action, time, and reason. The goal is to make necessary changes deliberately while retaining useful evidence where feasible.
Start with observed facts
Describe the concern in terms that can be tested. “The account downloaded these files during this period” is more useful than “the employee stole our information.” Identify the record supporting the observation, who discovered it, and what remains unknown.
A download may be consistent with normal work, an approved migration, automated synchronization, unauthorized copying, or use of a compromised account. A USB connection may warrant investigation without establishing which files moved or why. The investigation should test reasonable alternatives, including explanations that do not support misconduct.
Define the decision the organization needs to make. It might need to establish whether particular documents left an approved environment, identify a destination, understand the scope of exposure, or determine whether an initial alert was misleading. These questions should guide collection rather than a general search for anything unfavorable about the employee.
Establish authority and review boundaries
Before collecting or reviewing information, have counsel and the appropriate organizational decision makers confirm the authority, purpose, and scope. Ownership of a laptop does not resolve every issue involving personal accounts, private communications, employment obligations, or information belonging to third parties.
Agree on the relevant people, devices, accounts, dates, document categories, and permitted methods. Specify who may access the collected material and how unrelated personal or potentially privileged information will be handled. If a personal device or account may hold relevant evidence, obtain advice about the appropriate consent or legal process rather than asking staff to improvise access.
NIST's guide to integrating forensic techniques into incident response recommends involving management and legal counsel in the application of forensic techniques. The publication is general technical guidance, not a determination of an employer's rights in any jurisdiction. NIST SP 800-86 Guide to Integrating Forensic Techniques into Incident Response (opens in a new tab)
Coordinate preservation with offboarding
Give IT a specific, authorized preservation instruction before routine cleanup where possible. Identify the affected assets and the actions requiring coordination. A vague request to “save everything” may leave people unsure whether they should continue the normal offboarding workflow.
The initial checklist should address:
- Assigned laptops, phones, removable media, and relevant shared workstations.
- Work email, cloud storage, collaboration accounts, and business applications.
- Available security, identity, endpoint, and audit logs.
- Existing backups and any relevant retention settings.
- Account deletion, license changes, device resets, reimaging, and equipment reassignment.
- Who will record containment changes and preserve the resulting administrative history.
The exact sequence depends on the risk and environment. Account suspension, token revocation, or removal of access may be urgent. Preservation should be coordinated with those decisions rather than used as a reason to leave harmful access in place.
Avoid opening files repeatedly on the original laptop to see what looks suspicious. Record its condition and location, restrict handling, and obtain collection instructions. If someone has already examined it, document what they did instead of concealing the intervention.
Identify evidence beyond the employee's laptop
A device can be important, but the relevant activity may span several systems. Build a source map that links each question to potential evidence.
Document records: Identify the files of concern, relevant versions, normal storage locations, permissions, and business owners. Preserve examples that can help distinguish the actual documents from similarly named material.
Endpoint records: Depending on the system and available collection, a device may contain artifacts relevant to file handling, application use, or attached storage. Ask which observations can be supported and avoid assuming a complete record of every action exists.
Cloud audit records: These may record downloads, sharing events, or other supported actions. Microsoft, for example, documents distinct audit activities for file downloads and sharing-related operations. The event definition matters when interpreting a record. Microsoft Purview Audit log activities (opens in a new tab)
Identity and security records: Relevant records may help assess sign-ins, session activity, administrative changes, and whether account compromise is a plausible explanation. Correlate them with the file activity rather than assuming that an account name identifies the person operating it.
Business context: Approved projects, travel, handover instructions, support tickets, and normal work patterns can help explain activity. Collect this context through appropriate channels. A technically unusual event may still have an authorized explanation.
Check log retention immediately
Do not assume that a cloud provider keeps every relevant event indefinitely. Confirm what logging was enabled, which records are available, the retention settings, and any licensing limitations in the actual environment.
Microsoft's Purview documentation illustrates the issue: audit retention varies with licensing, workload, and policy. Its published defaults do not substitute for checking the tenant and the specific records involved. Microsoft Purview Manage audit log retention policies (opens in a new tab)
Preserve available records through an approved method, retaining their original fields and documenting the export scope. A screenshot of a dashboard may be useful for an initial alert but may omit details needed for analysis. Record the query, date range, filters, export time, and any known limits. Check whether the export actually covers the requested period before treating collection as complete.
Build a timeline without overstating it
An investigation becomes more useful when it connects observations across sources. A timeline might place document access, account activity, sharing changes, and relevant business events in order. It should identify the source of each event and explain time-zone normalization.
Keep the steps distinct. Accessing a file, downloading it, transmitting it to a destination, and using it outside the organization are different propositions. Evidence supporting one may not establish the others. Similarly, a shared link may have been created without evidence that an external person opened it.
Ask the examiner to describe confidence and gaps. If destination evidence is unavailable, say so. If a finding depends on a particular interpretation of a log entry, identify that dependency. An unexplained gap should remain a question until there is evidence supporting a conclusion.
Questions business leaders should ask
Should we confront the employee first?
Coordinate that decision with counsel and HR. Interviews and employment actions can affect the investigation and the people involved. Preserve time-sensitive evidence where appropriate and plan who will communicate, what they will ask, and how the response will be recorded.
Can IT simply copy the user's folders?
A folder copy may preserve some business content, but it may not address the forensic questions or retain all relevant context. Ask an examiner whether the planned method is sufficient before relying on it as the only collection.
Does a large download prove theft?
No. Establish what the record means, whether the activity was authorized, who or what operated the account, and whether other sources support an unauthorized transfer. Keep the concern labeled as suspected until the evidence supports a stronger statement.
What if we already reset the laptop?
Document when and how it happened. Do not assume the investigation is over or that recovery is guaranteed. Other sources, such as existing backups or cloud records, may still answer some questions. Their availability needs prompt assessment.
Make the next step specific
Prepare a short intake summary containing the observed event, important dates, documents at issue, affected systems, current access status, and steps already taken. Keep accusations separate from verified facts and restrict circulation to appropriate people.
Contact DFI Forensics to discuss a preservation and examination plan for suspected employee data theft. The useful first outcome is a clear list of sources to preserve, questions to test, and decisions requiring counsel or management before further work proceeds.
The examination should distinguish observed activity from conclusions about intent or misconduct. Counsel can advise on the legal and employment decisions that follow.
