Departing Employees · Data Theft · Trade Secret Matters
Insider threat and data theft
A resignation lands on a Friday. On Monday someone notices that the same employee spent two final weeks opening files nobody in that role had ever needed. The question is what left with them, and the laptop that answers it is already in the reimaging queue.
Insider matters are decided on the ordinary record.
There is rarely a dramatic artifact. What there is instead is a pattern assembled from unremarkable pieces: a USB serial number that appears in the registry for the first time eleven days before a resignation, a personal sync client installed on a corporate laptop, a folder built in Downloads and then deleted, an export run at a scale nobody in that role has ever run before. Individually, each is explainable. Together, in order, they are not.
The pattern only exists if the device is preserved before it is wiped.
Scope
What gets examined
USB and removable media activity
Device serial numbers, vendor and product identifiers, first and last connection times, assigned drive letters, and the user account each device was attached under. Where the media itself is available, the files written to it are compared against the source.
Cloud sync and personal account use
Personal OneDrive, Google Drive, Dropbox, and Box clients installed alongside corporate ones. Sync logs, local cache directories, and account bindings that show which files moved into an account the company does not control.
Mass download and staging behavior
Bulk access to file shares, document management systems, CRM and code repositories, followed by collection into archives or staging folders. Volume, timing, and whether the activity fits the person's normal work.
Exfiltration to personal devices and accounts
Webmail attachments, personal messaging clients, printing, screenshots, AirDrop and Bluetooth transfer, and phones or tablets connected to a corporate machine. The route matters, because each route leaves a different record.
Communication review
Email, Teams, and chat content collected from the client tenant and processed into reviewable form, scoped to custodians and date ranges the matter supports. Delivered for counsel or human resources to review, with the collection method documented.
Anti-forensic and cleanup activity
Wiping utilities, browser history clearing, recycle bin emptying, file renaming, and timestamps that do not agree with one another. The attempt to remove a record is itself a record.
Matters
Departures, non-competes, and trade secrets
Most of this work arrives attached to a separation. An employee leaves for a competitor, and either the former employer wants to know what went with them or the new employer wants to establish that nothing did. Both are the same examination performed with the same rigor, and 4n6PI is engaged by whichever side retains it.
- Separation and offboarding matters. Preservation of the departing custodian's laptop, phone, and cloud accounts before the device returns to the refresh pool, followed by analysis if the preservation shows something worth pursuing.
- Non-compete and trade secret support. Findings prepared for counsel, describing what was accessed, copied, or transferred, on what dates, by which account, and through which mechanism.
- Policy violation and human resources matters. Acceptable use, unauthorized access to systems or records, and misuse of company data, documented for an internal decision rather than an outside filing.
- Incoming employee clearance. Examination of a new hire's issued device and account activity to establish that no former employer material was brought in.
4n6PI examines devices and accounts. Whether the findings support a claim is a question for the client and its counsel, and 4n6PI does not answer it.
Engage
When to call
- An employee has resigned and is going to a competitor, and the laptop has not yet been reissued
- A file share, repository, or customer database shows an access pattern nobody can explain
- A departing employee's manager reports that documents were downloaded in the final two weeks
- Counsel has a non-compete or trade secret matter and needs the device record examined
- Human resources needs findings that will survive being questioned by the employee's attorney
- A former employer has accused a new hire of bringing material with them
Before the laptop goes back in the pool
Do not have IT log in to look around, and do not run a search across the machine to see whether there is anything to worry about. Every one of those actions writes to the disk and changes the timestamps that the investigation depends on. Pull the device from the refresh queue, leave it as it is, and call. Preservation can happen the same week whether or not an investigation follows.
Pricing
Preservation and analysis are priced apart
Preserving a departing employee's laptop costs a flat $1,500. Preserving a phone costs a flat $2,500. Neither commits the organization to an investigation. If the preserved image later turns out to matter, analysis runs at $150 per hour, and if it never matters, the image sits untouched and the matter ends there.
That is the cheapest insurance available in a separation, and it has to be bought before the device is reissued. A standing retainer puts the terms in place ahead of the resignation, at no cost to establish.
The device is the only witness that cannot revise its story
People remember selectively and describe events in their own favor. A registry hive does neither. Preserve the machine first, and decide what to do with it after.