Tips on Steps to Take in Suspicious Departing Employee Cases

From The Metropolitan Corporate Counsel, an interesting article from two Aon consultants entitled "In Search Of Lost Assets: Using Computer Forensics In Intellectual Property and Trade Secret Theft Investigations."

Here's some worthy advice from the article:

When concerns of wrongdoing arise, the suspected employee's computer should be turned off immediately and secured until a computer forensic expert can properly image the hard drive. This specialist will create a forensic image of the hard drive, which will provide a mirror copy of the hard drive's contents. An analysis of the image will then be conducted - not the original image... Depending on the nature and sensitivity of the matter, the original hard drive will either be secured or placed back into service for future use.

It is prudent to consider retaining an independent third-party computer forensic expert to conduct the analysis of any computers that may have been used in the crime. Using an impartial expert helps maintain objectivity and independence, which will work to counsel's advantage if the matter results in litigation and requires expert testimony.