Disgruntled Ex-Employee: An employee was terminated for multiple violations of the company’s policies. As she departed, she warned them that she would sue them for wrongful termination. Per the company’s existing policy at the time, the employee’s computer was formatted and issued to a new employee. Six months later, the company received notice of a law suit and was ordered to preserve the data from several computers, including the one used by the former employee. Since the data from the employee’s computer was not preserved, the company faced sanctions due to spoliation of relevant data.
Lesson learned: Your company’s policies should address how to preserve data of the employees after termination - especially if you “reasonably anticipate” litigation.
Elder Abuser: An elderly lady with substantial wealth required the assistance of a guardian due to declining mental capacity. Unfortunately, the appointed guardian financially exploited her. Computer forensics of the guardian’s computer identified numerous suspicious financial transactions and evidence of identity theft.
Lesson learned: The primary lesson learned is to ensure guardians are trustworthy. The computer forensic lesson is that computers contain a treasure trove of information and can identify unknown assets and bank accounts, purchases, internet search criteria, and other evidence of wrong doing.
Perverted Teacher: A teacher (who was also the tennis coach) was suspected of accessing pornography from his school computer. The teacher denied any wrong doing. The school turned the computer over to GCIS for analysis to establish the extent of the activity and other possible inappropriate behavior. A forensic review of the graphic files on the computer disclosed one image that appeared to be an unsuccessful attempt to photograph up a female’s skirt. The female was holding a tennis racket. Analysis of the metadata of the photo disclosed it was taken with an iPhone that captured the GPS location of the image. Analysis of that data disclosed it was taken on the school’s tennis courts. When confronted with the information, the teacher resigned.
Lesson learned: Computer forensics not only involves computers, but may include cell phones and other mobile devices. Had this teacher’s cell phone been analyzed, it may have uncovered even more disturbing information.
Thievin' Ex-Employee: An employee of a leasing company unexpectedly quit and went to work for a competitor. Several weeks later, the employer noticed several major clients began to use the competitor, so he contacted one of them who informed them the former employee contacted them (in violation of his non-compete agreement) and offered them a substantial savings. The employer filed a lawsuit against the former employee and they judge ordered him to surrender to GCIS his personal computer, new work computer and cell phone. Analysis of these devices disclosed the former employee emailed to himself the company’s client database. The employee attempted to hide the database on his personal computer, but forensic analysis located it.
Lesson learned: Computer forensics can be extremely valuable in piecing together the details of wrongdoing. By quickly preserving and analyzing computer data, a company may be able to minimize its damages and seek damages in court.