(866) 458-4993 
Find out what happened to your company data
A business data theft investigation examines whether company information was accessed, copied, transferred, or deleted. Forensic Discovery helps HR, internal legal teams, and business leaders investigate concerns about departing employees, contractors, and other insiders. We connect available device and account records with the business information at issue, then explain what the evidence supports and what remains unresolved.
Customer lists, pricing sheets, financial records, sales pipelines, and internal documents can move through several channels. Digital activity may leave traces, but records can be missing, overwritten, or unavailable. An investigation tests the concern against the available evidence, including ordinary work activity and other explanations.
This work is part of our digital forensics services. For disputes centered on information counsel identifies as potentially protected, source code, or alleged misappropriation, see intellectual property theft investigations. Customer lists and other business records may also raise those issues, depending on the facts and applicable law.
What a business data theft investigation can establish
Departing employee activity
We compare the resignation and offboarding timeline with activity involving the information you identify. A burst of downloads, a new external drive, or a personal account may warrant examination. Each needs context: routine exports, approved remote work, and automated processes can produce similar records. Our departing employee investigation article introduces this type of matter.
USB, personal cloud, and email transfers
USB connection history, file references, cloud sync records, browser artifacts, and messages may help reconstruct a possible transfer route. A connected drive does not by itself establish which files were copied. We look for corroborating records and distinguish file access, local copying, upload activity, and evidence of receipt when the sources permit.
Deletion and changes to the record
We examine available signs of mass deletion, cleared history, or wiping activity alongside the remaining data. Such changes may have routine explanations. Encryption, the behavior of solid state storage, overwriting, and a reset device can restrict recovery. We report those limits rather than treating missing records as evidence of concealment.
Access after departure
Retained account activity may show sessions, downloads, forwarding changes, or use after an expected cutoff. We compare these events with the access history supplied by the business. Shared credentials, delegated access, service activity, and session persistence can complicate attribution. An account name alone does not identify the person responsible.
A timeline with clear limits
We correlate records around the relevant business events, noting time zones, clock differences, and gaps. The resulting timeline separates observations from interpretations. Identifying a device or account event is different from establishing a person's actions or intent; counsel and the business assess the findings in context.
When to bring in a data theft investigation team
A key employee resigns and joins a competitor
You want to know whether customer records, pricing, or proposals moved before notice was given. We help define the relevant information, people, devices, and time window. A focused examination can compare activity with ordinary duties and authorized access, giving HR and counsel a clearer factual basis for their next steps.
For an offboarding matter, our departing employee investigations page provides another starting point. This service covers the wider organizational investigation.
You discover company files on a personal account or drive
A screenshot or file listing raises questions, but it may not explain the origin, version, transfer route, or destination. We examine authorized sources and compare the material with company records where available. Contents of a personal account require a separate assessment of lawful authority and access; credentials or ownership of a company device alone do not settle that question.
You need facts before a demand letter or employment decision
We can organize the digital record so counsel and HR can evaluate the concern, contradictory evidence, and missing information. The technical work does not decide a policy violation, contractual breach, or employment outcome. The scope can address suspected unauthorized workstation access. For conduct concerns beyond taking data, see employee misconduct investigations.
First steps when you suspect data removal
- Identify the devices, accounts, information, and dates involved, including systems managed by third parties.
- Record each device's current condition and who has handled it; arrange secure custody under an agreed plan.
- Coordinate access restrictions with authorized IT, counsel, and the examiner so containment and preservation needs are considered together.
- Seek guidance specific to the device before changing power, connectivity or settings, or before reviewing the device’s contents. Appropriate handling depends on the device's state.
- Coordinate preservation before routine account deletion, device reassignment, or retention changes. Counsel determines legal hold scope and obligations.
Devices, accounts, and possible transfer channels
| Source | Records we may examine | Interpretation boundary |
|---|---|---|
| Company laptop or desktop | File references, recent activity, USB history, browser artifacts, deleted material where recoverable | Access or a file reference alone does not establish copying. |
| Company phone | Available messages, attachments, app records, and accessible backups | Device state, encryption, app behavior, and authorization limit scope. |
| Company Microsoft 365 or Google Workspace account | Available audit events, sharing records, email, and forwarding settings | Licensing, configuration, and retention affect the record. |
| Personal cloud or webmail used on company systems | Local sync folders, browser traces, and available message artifacts | Device traces do not provide automatic access to a personal account. |
| External drives and USB devices | Connection records and file comparisons when the media is available | Connection does not establish the contents transferred. |
| Shared drives and printing records | Available access, version, export, or print activity | A log entry may not establish the full document or its recipient. |
Interpreting the records. Time zones, clock differences, gaps, and shared or delegated access can complicate interpretation. A device or account event alone does not identify a person or establish intent.
Services for the sources in your investigation
- Computers: The underlying computer examination is described in computer forensics.
- Mobile devices: Examination of company phones is described in mobile device forensics.
- Company cloud accounts: Company account collection and audit analysis are covered by cloud-based forensics.
- Email collection for production: Collecting email for a production has a separate forensically sound email collection scope.
How the investigation works
Define the questions
We scope the concern with HR, counsel, and authorized business contacts: what information matters, who had access, relevant systems, dates, authority, and deadlines.
Preserve the agreed sources
Collection may include forensic images or targeted exports, with chain of custody and method documentation. Hash verification compares the bytes of a defined collected file or image at recorded points. It does not establish collection completeness. Larger programs use data preservation and collection.
Examine possible transfer activity
We compare available artifacts with the information at issue, testing routes and alternate explanations. Read about conducting a departing employee forensic investigation.
Reconstruct the sequence
We correlate device and account events with the business timeline, documenting time handling, conflicting records, attribution limits, and unanswered questions.
Review and report findings
We explain the supported findings, sources, methods, exhibits, and limitations. A focused findings review helps the business and counsel understand the record.
Support the next stage
The engagement can include a declaration or testimony and technical support for return or remediation work directed by counsel. Verification stays bounded by accessible sources and agreed methods.
If the matter proceeds to review or production, relevant collected material can move into a separately scoped eDiscovery workflow.
Reports, declarations, and testimony
Your report explains what the evidence supports about the information involved, possible transfer routes, and timing. Exhibits connect findings to source records. Depending on the engagement, we can prepare a declaration or affidavit and provide deposition or trial testimony through our expert witness and testimony services. Counsel determines how to use the work; the court determines admissibility.
Discuss the findings your team needsAn investigation built around the business questions
Forensic Discovery brings collection, examination, and reporting into a coordinated investigation. We start with the information you are concerned about and the decisions you need to support, then match the examination to available sources.
- Consultative scoping that identifies priorities and source limitations.
- Documented handling and chain of custody for collected material.
- Correlated findings that distinguish supported activity from inference.
- Reports that explain alternative explanations and unresolved gaps.
Work can be coordinated under counsel's direction. That arrangement does not itself establish privilege or determine the legal status of the information.
Who we work with
We work with HR, internal legal teams and outside counsel, business owners, executives, sales and finance leaders, IT, and compliance teams. Forensic Discovery accepts engagements from law firms and businesses. We do not accept direct individual consumer matters; a law firm representing an individual may contact us. See our offices and service locations for location information, then contact us to discuss engagement arrangements.
Scoping and pricing
Ask for a written scope and estimate before work begins. Cost depends on the people and devices involved, authorized account access, data volume, information to compare, timeline depth, deadline, and anticipated reporting or testimony. A focused initial phase can address priority questions before expanding the work. Discuss access or retention problems at the outset so the proposal reflects the sources actually available.
Business data theft investigation questions
How can an investigation show what an employee took?
We compare company information with available device, account, message, and transfer records. Several sources may support a finding that particular data moved. Sometimes the record supports only access or attempted transfer. Computer forensics supplies the examination of the device; the investigation correlates those findings with other sources and the business timeline.
An employee just resigned. What should we do with their laptop and phone?
Document the devices and their current state, arrange secure custody, and coordinate with authorized IT, counsel, and an examiner before changing settings or reviewing contents. Power and connectivity decisions depend on the device and situation. Preserve relevant accounts before routine offboarding removes records. Our article on departing employee investigation risks provides background.
Can you tell if files went to personal Dropbox, Google Drive, or Gmail?
Local sync records, browser artifacts, messages, and available company audit logs may identify a route or destination. They may not identify every file or confirm receipt. Access to the personal account itself requires separate lawful authority and an available collection path. We explain which part of a proposed transfer the collected evidence actually supports.
What if the employee deleted files or wiped the laptop?
Some remaining artifacts, backups, messages, or company logs may still help reconstruct activity. Recovery depends on the storage, encryption, overwriting, and what was preserved. Deletion or reset activity can have more than one explanation. We do not promise recovery or infer concealment solely from a missing record.
Can you investigate a former employee's company email and cloud account?
Potentially, when authorized access and relevant retained data are available. An account that still exists may nevertheless lack older audit records or deleted content. We assess preservation, retention, licensing, and source access before confirming the scope. The article on data theft considerations before employees leave offers related background.
How is business data theft different from intellectual property theft?
This service organizes the business response to suspected removal of company information. Intellectual property theft investigations focus on disputes involving information counsel identifies as potentially protected and the examination questions or protocols that follow. The matters can overlap: customer lists, pricing, and internal documents may raise questions about protected information. Counsel determines the legal classification.
How long does a data theft investigation take?
Timing depends on access, device state, source volume, retention, comparison material, and the questions involved. A narrow initial phase may address priority issues before a wider analysis. We discuss deadlines during scoping and update expectations when collection gaps or new sources emerge. We do not promise a fixed preservation or findings timetable.
How much does a business data theft investigation cost?
The proposal reflects the devices and accounts, people involved, data volume, timeline, deadline, and required deliverables. Reporting and testimony may need separate phases. Confirm the proposed scope and pricing before starting. If the first phase identifies a reason to expand, that additional work needs an agreed scope.
Can findings support a demand letter, employment decision, or court proceeding?
Documented methods, source records, and chain of custody can help counsel evaluate the findings for those purposes. Technical findings do not decide a contractual breach, employee misconduct, or legal entitlement. HR and counsel make the relevant decisions; courts control admissibility. We explain uncertainty and contradictory evidence alongside the findings.
Do you work with outside counsel or directly with the business?
We work with law firms and businesses, including HR and internal legal teams. The engagement identifies authorized contacts, source authority, and the reporting path. Where litigation is involved, counsel directs legal scope and use. Our expert testimony services can support a separately agreed next stage.
Schedule a Free Consultation
Tell us what information may be involved, who had access, the relevant dates, and what has happened to the devices and accounts so far. We can discuss a focused business data theft investigation and the sources it may require.
Call (866) 458-4993 or contact Forensic Discovery.
Use the form for a general inquiry. Please do not send confidential files, passwords, or sensitive evidence; ask us about an appropriate transfer method.
"*" indicates required fields