Digital forensics in employee misconduct investigations: what examiners look for

An employee may be sending client files to a personal account. A manager may be accused of harassment by text. A departing salesperson may have copied the customer list on the way out. When misconduct involves computers, phones or email, the evidence is digital, and it is easy to damage without meaning to.

Here is when an HR investigation needs digital forensics, what to do and avoid in the first 48 hours, what a forensic examiner actually looks for, and what access logs can and cannot prove.

When misconduct needs forensics

Not every HR matter does. Forensics is worth it when the key evidence lives on a device or in an account, and when the outcome may be challenged: a termination that could become a lawsuit, a suspected theft of data or money, harassment involving messages, or anything you may need to show to law enforcement, an insurer or a court. Our overview of five scenarios where digital forensics helps covers the wider range.

The first 48 hours

The goal in the first hours is not to investigate. It is to preserve.

Do

• Call your attorney first. Counsel can direct the investigation, which may help keep the work under legal privilege.
• Keep company devices exactly as they are. If a laptop is on, ask an examiner before you shut it down or unplug it.
• Stop any automatic cleanup: email deletion policies, mailbox retention changes and scheduled device resets.
• Write down who has had the device and when.

Don't

• Ask IT to "check the computer." Opening files and browsing folders changes the timestamps an examiner relies on.
• Reimage or reissue the device to someone else.
• Delete the user's account before evidence is collected. In many cloud systems that also removes mailbox data.
• Confront the employee before the evidence is preserved.

What examiners look for

A forensic examiner makes a verified copy of each device or account first, then works only from the copy. From there, the usual sources are:

Sign ins and access logs

When an account signed in, from where, and on what device. In Microsoft 365 and Google Workspace, audit logs record actions such as file downloads, sharing changes and mailbox access.

File activity and USB devices

Which files were opened, copied, renamed or deleted, and whether a USB drive or phone was connected around the same time.

Email and forwarding rules

Messages sent to personal addresses, large attachments, and rules that quietly forward or delete mail. Forwarding rules are a common sign of both data theft and account takeover.

Cloud sync and personal accounts

Personal file sharing apps on a work computer, browser sessions signed in to personal email, and sync folders that copy work files to another service.

Deleted files and wiping

Deleted data is often recoverable. Even when it isn't, the examiner can often show that wiping tools were run, and when.

Messages

Chat, text and collaboration messages, extracted with the metadata that shows when they were sent and received. A screenshot can be challenged. A forensic extraction is much harder to dispute.

The value and limits of access logs

Access logs are some of the most useful evidence in misconduct cases, because they show timing and patterns: an account downloading hundreds of files the week before a resignation, or opening records it had no business reason to touch.

They also have limits that matter in a dispute:

• Logs show an account, not a person. If passwords are shared or a workstation is left signed in, the employee can argue someone else did it. Device evidence, badge records and camera footage can help connect the account to a person.
• Logs only exist if logging was turned on. Many small businesses never enable the audit features their software includes.
• Logs expire. Cloud platforms keep audit records for a limited time that depends on your license. By default, Microsoft's standard audit tier keeps records for 180 days. If you suspect a problem, export the logs now.
• Time zones and clock settings have to be reconciled before a timeline is trusted.

Role based access helps here, because an account that can only reach what the job requires makes unusual access stand out.

Chain of custody

Evidence is only as good as the record of how it was handled. A chain of custody document lists who collected each item, when, how it was copied and verified, and everyone who handled it afterward. Without it, opposing counsel can question whether the evidence was altered.

Who should do the work

Use an examiner who is independent of the people involved, and ideally of the person who runs your network. Your IT provider may be a witness, may have had access to the same systems, or may simply lack forensic training and tools. An independent examiner's findings are easier to defend.

In one case, a Montana small business needed to know what a departing employee with administrative access to finance, HR and banking systems could still reach. The departing admin case study shows how every access point was found, revoked and checked for unusual past activity.

Personal devices and privacy

Company owned devices and accounts are usually straightforward to examine, depending on your policies. Personal phones and accounts are not, even when they were used for work. Involve counsel before collecting anything from a personal device. If the employee or data is outside the United States, privacy laws such as the GDPR add their own rules on monitoring and access logs.

Where to start

If you suspect misconduct right now, call your attorney, keep the devices untouched, and talk to a forensic examiner before anyone else looks. Our incident response and forensics team images devices before anything is changed, with chain of custody from the first image.