Digital Forensics
If you suspect business information has been moved or misused, we help you test that concern against the digital evidence. We examine relevant activity before or after an employee departure without assuming misconduct.
UNDERSTAND THE EVIDENCE
When business information may have left with an employee, the first task is not to confirm a suspicion. It is to preserve a reliable record and identify the facts that will change your next decision. We help management and legal counsel examine the information at risk, the activity surrounding it and the explanations the available evidence supports.
01 / THE EXAMINATION
Begin with the material that matters: customer records, pricing, proposals, designs, source code or other sensitive files. Identify the relevant people, dates and systems, along with the access arrangements and ordinary work that may explain the activity. We can then turn a general concern into questions that the digital records can test.
Business records and counsel's instructions provide context that technical artifacts cannot supply alone. Confidentiality obligations, approval to use a device or account, and whether particular work was authorized are not established merely by finding a file. We distinguish technical findings from the employment or legal conclusions that others must assess.
02 / THE EXAMINATION
Device reassignment, resets, account deletion, licence changes and routine log expiry can remove useful evidence. Coordinate preservation with counsel, DFI and a trusted IT contact before an informal search expands into an uncontrolled investigation. Identify relevant devices, mailboxes, shared locations, backups and activity logs, and record what has actually been preserved.
Necessary containment should not wait while active harm continues. If access must be restricted or sessions revoked, document the action, operator, time and reason and coordinate with the examiner where feasible. Tell us about searches, exports, password changes or interviews that have already taken place so that their effect can be considered.
03 / THE EXAMINATION
A laptop may show file activity and removable-device connections; an email system may show a message and its attachment; a cloud platform may show sharing or download events. None of these sources necessarily tells the whole story. We look for the relationships between the information, the event and the possible destination.
Microsoft 365 mailbox content, message trace, Purview audit and Entra sign-in records serve different purposes and may have different availability. Preserving a mailbox is not a complete plan for preserving activity logs. We assess the tenant's actual configuration, licensing and retained date coverage rather than relying on a generic retention assumption.
04 / THE EXAMINATION
A USB connection does not prove that files were copied. A file-access event may reflect normal work. An account event does not automatically identify the person at the keyboard. We compare available records, dates, file identities, destinations and user context to assess whether the evidence supports a transfer, only an opportunity for one, or a different explanation.
We also identify contrary and missing evidence. A finding that does not support the concern can be as useful as one that does. Where logs have expired or a destination is unavailable, we explain what remains unresolved rather than treating the gap as proof that no activity occurred.
05 / THE EXAMINATION
An agreed early findings briefing can address urgent questions while a wider examination continues. It must be clear which sources have been reviewed and which findings are preliminary. The final scope may include a source-linked chronology, supporting files and communications, and a forensic report explaining methods, findings, alternatives and limitations.
Counsel can use the factual record when assessing next steps, but a forensic result does not itself determine a remedy, establish liability or guarantee a court outcome. We agree the reporting requirements with you and your legal team, including whether a proceeding-specific report or testimony needs separate scope.
RELEVANT SOURCES
The useful combination depends on the concern. We identify sources and preservation priorities before committing to an examination of everything.
Files, application activity, browser and sync records, archive creation, USB history and available deleted artifacts can contribute to a timeline. Where a destination drive is available, its contents may help test an apparent transfer.
Native messages, attachments, forwarding arrangements and relevant conversations can identify what was communicated and to whom. Mail-flow records and message content must be interpreted separately.
Shared locations, available file versions, access and sharing records may show how information moved. Ordinary sync, collaboration and approved external sharing need to be distinguished from the suspected conduct.
Retained sign-in, audit, endpoint and administrative records may connect account use and system changes. Record coverage, event meaning and gaps are part of the analysis—not an afterthought.
Access policies, approved duties, relevant dates, existing alerts and IT actions help interpret the technical record. Related custodians, backups and service providers may hold evidence absent from the employee's account.
HOW WE WORK
We connect the scope, sources and methods to the result you need, with the limits of the evidence made clear.
Identify the information, suspected conduct, urgent risks and questions. Confirm authority and the roles of management, counsel and IT.
Prioritize relevant devices, content and short-lived records. Document collections, handling and necessary containment changes.
Correlate file, device and account activity, assess destinations and authorization context, and test alternative explanations.
Explain supported findings and remaining uncertainty. Deliver the agreed chronology, evidence and reporting in a useful review format.
BEFORE WE BEGIN
A clear first discussion helps us identify a useful scope. Use the contact page for an initial inquiry, not to upload evidence or credentials.
COMMON QUESTIONS
We can examine whether available records support access, copying, transmission, sharing or deletion, and explain their connection to accounts and devices. Whether the conduct amounts to theft or another legal wrong depends on facts and legal requirements beyond a single technical event. We do not start by assuming the allegation is true.
Coordinate an evidence-preservation plan before substantive browsing or an informal investigation. Routine use can change the record. IT remains important for controlled access, system knowledge and necessary containment. If searches or changes have already happened, preserve a record of them and tell us.
Not by itself. Content preservation and the collection of message-trace, audit, sign-in or other activity records address different sources. Their availability and retention depend on the platform and configuration. We help identify the relevant sources and verify actual date coverage.
Do not assume that a workplace concern or company-owned device provides unrestricted authority. Counsel should resolve the applicable privacy, employment, consent or court-order requirements. We define the technical scope and access arrangements around the authority established for the matter.
General educational guidance. Source-specific capabilities and available records require assessment; legal authority and procedure should be addressed with counsel.
RELATED ARTICLES
We share the questions and methods that can help you make a more informed next decision.
YOUR NEXT STEP
Tell us about your situation. We can help you identify the evidence, support, or preparation that fits.
