When someone leaves your business and you suspect they’ve taken client lists, pricing or other confidential files, the natural reaction is to start digging. That instinct can destroy the very evidence you need. Here’s what to do instead.
The first rule: don’t investigate it yourself
Every time someone logs into a computer, opens a file or plugs in a device, the system records it, and can overwrite older records in the process. A well-meaning IT person “having a quick look” can change file dates, overwrite deleted data and give the other side an argument that the evidence was tampered with.
What not to do
- Don’t wipe, reset or reissue the person’s laptop or phone. Reissuing a device to a new staff member is one of the most common ways evidence is lost.
- Don’t delete their accounts. Deleting a Microsoft 365 or Google Workspace account can remove their mailbox and files, and start the clock on permanent deletion.
- Don’t browse their files or email to “see what’s there”.
- Don’t confront the person or tip them off before you’ve taken advice. It gives them a chance to delete what they took.
What to do
- Leave devices exactly as they are. If it’s on, leave it on; if it’s off, leave it off. Store it somewhere secure.
- Suspend, don’t delete. Block sign-in to their accounts and change shared passwords they knew, but keep the accounts and data intact.
- Write things down. Who has handled the device, when, and what they did. This becomes part of the chain of custody.
- Act quickly on cloud records. Activity logs in Microsoft 365 and similar systems are only kept for a limited time (see our guide to Microsoft 365 log retention).
- Get legal and forensic advice early. Your lawyer can advise on your rights and options; a forensic examiner can preserve the evidence properly.
What a forensic examination can usually show
Even when files have been deleted, the records often show which files were downloaded, synced to a personal phone or copied to USB, when it happened, and from which device or location. Properly preserved, that becomes a dated timeline your lawyers can act on.
Preventing it next time
- Have a written offboarding checklist that removes access on the person’s last day, not weeks later.
- Make sure activity logging is switched on and kept for long enough.
- Limit who can download or share large volumes of company data.
If you’re dealing with this now, call us on 0467 697 148. The sooner evidence is preserved, the more we can show.
This guide is general information, not legal advice. Speak to a lawyer about your specific situation.