Previously, attorney Brian G. Cesaratto outlined the four things you should do immediately if you suspect an employee may be trying to steal or sabotage company computer files. Now, you are ready to begin the investigation. And we pick up where the story left off . . .

You call back the head of product development. You advise her that the necessary policies are in place to conduct a full investigation of the engineer’s computer. Given the stakes involved, you decide to move forward over the weekend by having an expert come in and make a mirror image of the engineer’s computer. Doing so allows the investigation to proceed without alerting the engineer that he is under suspicion and risking the destruction of evidence that you may need later ― either for use in implementing discipline or in court. read more…

What should you do when you suspect an employee with access to sensitive and important computer files has become disgruntled and may have malicious plans (information theft, system sabotage)? In the first post of two, attorney Brian G. Cesaratto sets the scene, outlines some of the forensic concerns, and tells you the four things you must do immediately.

The head of product development telephones you late one Friday afternoon to tell you she believes one of the engineers on her team is leaving. She has a strong suspicion that he may be stealing highly sensitive company files and information. She explains that the engineer, who is working on a high-priority new product, may be looking to leave because of a poor performance review weeks earlier that resulted in him not receiving a pay increase for the coming year. There have been significant issues with his performance and attitude toward work since then.

read more…