This case study discusses a high-tech manufacturing company’s allegation of unauthorised taking of valuable company designs by an employee during a company restructure. The employee’s laptop was requested for forensic examination, revealing attempts to erase data and tamper with the device’s date settings.
Objective
The primary objective was to investigate whether the employee had indeed stolen company designs and to determine whether any attempts were made to erase or tamper with potential evidence on the laptop.
Approach
Notion Digital Forensics was engaged to conduct a thorough forensic examination of the employee’s laptop and other cloud-based evidence. The examination focused on identifying any signs of unauthorised downloading of company designs and determining if any attempts were made to erase or tamper with evidence.
Results
The forensic examination revealed that the laptop had been erased. Notion Digital Forensics was able to establish that the laptop’s clock had been altered to provide a misleading erasure date. The examination also provided the likely month and year when the erasure occurred.
Conclusion
The digital forensic examination provided crucial evidence that the employee had attempted to erase data and tamper with the laptop’s date settings. This information enabled the company to negotiate with the employee regarding the disposition of the stolen intellectual property. It also highlighted the need for adequate security controls to prevent employees from erasing devices and eliminating evidence of potential wrongdoing, even during challenging times such as the pandemic.
