When is digital forensics required: How should the process work for a suspicious employee computer?

Pull the plug, close the lid and do not touch that power button under any circumstances. Draft an official incident report signed by two authorized employees and lock the device in the company safe or a secure cabinet. Clearly document the computer's make, model serial number, and the condition of the tamper-evident security tape on the report.

To run an investigation on company machines, the information security policy and disclosures signed by the employee during onboarding are critical. If you don't have an asset assignment form stating the hardware was allocated strictly for business use, your investigation could be turned back on you in a countersuit claiming a violation of personal privacy.

We went through a similar thing last year. We hired an independent firm to image two computers and provide a forensic report, and they billed us 32.000 TL in total. But thanks to that report, the prosecutor's office issued a seizure warrant for the digital materials at the suspect's home within 3 weeks. In my opinion, it was totally worth the money.

USB connection logs are examined to detect unauthorized copying. By analyzing the USBSTOR keys in the Windows Registry, the 'setupapi.dev.log' file, and 'Shellbags' data, it can be established with 100% technical certainty which external drive (by serial number) was plugged in, when it was connected, and which folders were viewed.

On the computer the employee used was there a personal email account or personal session logged in outside of company ownership? Also, regarding the 40 GB transfer log you mentioned on the server side, is that specifically network traffic logs or file server access permission logs?

edit: I wrote something wrong above, sorry about that.

Even if you pour a fortune into a private digital forensics firm, the court won't base its judgment solely on that report. The moment the opposing party objects, the case will be sent to an official court expert anyway. If your company budget is tight it might make more sense to hand it directly over to the prosecutor's office and have it taken into evidence storage.

Three years ago in a similar case, our company manager turned on the computer plugged in a USB drive, and copied screenshots. During the trial the opposing counsel argued "Files were accessed at this hour, my client was not at the company at that time and the evidence has been tampered with," which got the report thrown out and we lost the lawsuit. That's why you should never touch it.

definitely dont let the it guys touh the device... back when we had this a guy turned on the pc saying he'd check the logs and the whole case blew up in court, best to leave it to the pros.

To get into the details: When you try to change everything at once, nothing settles.

Proven by experience.

You're right.

Quick summary for newcomers: The answer varies greatly by industry; there is no one-size-fits-all rule.

That's all, sorry if I went on too long.

I feel the same way. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

Hope this helps.

Let me write how it's done in practice. If 2FA is on, a stolen password alone is useless.

If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection. If I were you, I'd go this route.

let me clarify the techniacl side. start with a small trial; don't commit to everything at once.

if I were you, I'd go this route.

Good call starting this thread.

Thanks that was the answer I was looking for... honestly the real issue isn't the number but what it's based on.

The biggest time-waster for us was not knowing who had the final say. Hope this helps.

Thanks, this was very helpful. Start with a small trial; don't commit to everything at once.

When making a decision, first look at what data you have on hand. If you have questions, write them; I'll answer as best I can.

Noted thanks. Mistakes made on the what is digital forensics side are usually reversible but expensive.