The very technologies that make our lives easier and our jobs more productive and efficient are the same ones that make employee theft easier and more common. Gone are the days of smuggling out stacks of paper documents or bulky floppy disks and CDs: a small thumb drive can hold 1TB of data and be slipped unobtrusively into a pocket. The ease with which data can be copied and removed makes it easier for employees to rationalize their actions as being something other than theft. With employee theft of confidential information on the rise, it is important for employers to understand the role digital forensics plays in proving employee theft of data.
The Rise of Employee Theft of Confidential Information
A study by the cybersecurity firm Biscom found that 85% of employees admitted to taking company documents and information they had created when they left said company. Further studies showed that employees feel they have a “right” to data they created while with the company, even if company policy explicitly states otherwise. This data includes source codes and patent filings, customer databases, intellectual property, strategy documents, and trade secrets.
Digital Forensics and Employee Theft of Data
Digital forensics helps employers investigate and uncover employee theft of confidential information by uncovering the software and artifacts indicative of data theft. These can include:
- Files recently opened, edited or deleted – This information is helpful in determining what documents the employee may have stolen, as well as whether they tampered with or removed data. The timestamp information can also be helpful in proving probable cause.
- USB activity – Thumb drives and external hard drives are the most common tools in data theft, thanks to their small size and ability to hold large amounts of data. Thankfully, USBs also leave behind a substantial trail of valuable digital evidence. In most cases, the forensic examiner can determine the serial number and/or brand of a USB device as well as the first and last time that device was connected to the computer.
- Cloud storage use – If no USB activity is detected, the examiner will check to see that no cloud storage provider (Dropbox, Google Drive, Microsoft OneDrive, etc.) was accessed. Cloud storage applications typically have corresponding log files and databases that record what files were accessed, what activities were performed, and the user.
An investigation also reviews internet history, recently printed documents, and personal email account use for evidence of misconduct and theft. The results of a digital forensics investigation can provide employers with the foundation for legal action, such as a temporary restraining order, permanent injunction, or subpoena of personal devices. A digital forensics examiner also ensures that there is a clear chain of custody, protecting data from charges of spoliation, and ensuring it is admissible and defensible in court.
Uncovering Employee Theft of Confidential Information with Precise
Precise’s suite of digital forensics services includes our premier Departing Employee Package. This package helps businesses determine whether a departing employee has destroyed, obtained, or currently possesses intellectual and proprietary company property, or has violated a non-compete/confidentiality agreement. For more information on this service, call us today at 866-277-3247.
Recent Comments