IT Group Instructed to Investigate Employee Misuse of Laptop

IT Group was approached by an employer who required a forensic examination of a hard drive that had been allocated to one of its employees. The employee had recently been the subject of a disciplinary hearing and had stated the hard drive was frequently used to back-up his work computer.

The main objective of the investigation was to establish what the hard drive had been used for and whether it had been used purely for work purposes. The digital forensics team was tasked with; identifying what had been saved on the hard drive, how often it had been used and also whether the contents had been wiped prior to the disciplinary hearing.

In the first instance, it was apparent that a series of TV programmes had been downloaded onto the hard drive. It was also clear that a number of film streaming websites had been browsed and streamed films accessed.

The only evidence of any work-related files being present on the device was the night before the hearing. All personal files (primarily music and videos) had been deleted from the device during that evening. Our forensic analysis picked up evidence of the deleting process and the deleted files were able to be recovered.