IT Forensics · Business
How can a company check whether a departing employee has taken company data with them?
Shortly before leaving the company, customer lists, cost calculations or source code are often copied – sometimes accidentally, sometimes deliberately. It is often possible to determine whether and how data has been taken if the device is not reinstalled too hastily.
Why this question is important for a business
In the event of potential data leaks, significant economic assets, customer relationships, development know-how or competitive advantages are often at stake. A robust investigation must therefore precisely establish what data movements actually took place, without jumping to the conclusion that a legal infringement has occurred merely on the basis of a suspicion.
Technical background
Windows logs connected USB devices, opened files and folders in several separate entries. Cloud uploads, email forwards to private addresses and print jobs leave further traces. It is crucial to compare this with the period prior to leaving the organisation.
Relevant evidence and data sources
- USB devices (USBSTOR registry key, MountedDevices, Setupapi log, event logs)
- File and folder access (LNK files, jump lists, shellbags)
- Browser uploads and private cloud clients
- Email forwarding and mailbox rules (Microsoft 365 Audit Log)
- Print logs
Borders
- It is not possible to determine what happened to the data on a private device without access to it.
- File access does not automatically imply a copy; a copy does not automatically imply sharing.
Possible results
- Time taken for copying to USB or to the cloud
- No indication of carry-over via the audited channels
- List of affected files
Why LanCologne?
Any suspicion of data theft or the loss of confidential company information can have significant financial and legal consequences. This is precisely why the investigation must not begin with the desired outcome in mind.
Here’s how we do it
- Back up the device and account before returning or deleting them (legal hold).
- Specify the period (typically: from the weeks prior to notice of termination until the date of departure).
- Correlation of the evidence with a timeline; comparison with operational requirements.
A trade secret is a legal classification – data movement is a technical question of evidence
We can determine or narrow down which files were present, what technical protection measures were in place, and which acts of access, copying or transfer can be verified. Whether the information in question meets the criteria for a trade secret and whether an act was unauthorised or unlawful is assessed separately from a legal perspective.
No jumping to conclusions – not even when transfer patterns are conspicuous
Unusually high file access, a USB connection or a cloud login may give rise to further investigation, but do not in themselves constitute a conclusion. Alternative workflows are also examined. Where several explanations remain possible, this uncertainty is not replaced by an assumption.
Why LanCologne in the context of data portability and trade secrets?
LanCologne does not carry out investigations with the aim of confirming a pre-existing suspicion. We answer the specific technical question of evidence, document the underlying primary data and state just as clearly what cannot be proven. This provides the management and legal department with a factual basis that can also withstand subsequent technical cross-checking.
Legal framework
Where employees are concerned, Section 26 of the Federal Data Protection Act (BDSG) remains a key starting point. For the detection of criminal offences, Section 26(1) of the BDSG requires, amongst other things, documented factual grounds, necessity and proportionality; the employee’s legitimate interest must not outweigh these considerations. In addition, the principles of the GDPR apply, in particular lawfulness, purpose limitation and data minimisation.
The GeschGehG is central to trade secrets. Under Section 2(1) of the Trade Secrets Act, not all confidential information is sufficient: amongst other things, the information must have economic value because it is not generally known or readily accessible; it must be subject to confidentiality measures appropriate to the circumstances; and there must be a legitimate interest in maintaining its confidentiality.
Section 4 of the Trade Secrets Act (GeschGehG) prohibits, under certain conditions, amongst other things, unauthorised access to, unauthorised appropriation of, or unauthorised copying of electronic files that contain a trade secret or from which one can be derived. Use and disclosure may also be prohibited. It is not for the IT forensic expert to determine whether a technically verified incident fulfils the legal elements of an offence.
The Business Secrets Protection Act (GeschGehG) also contains exceptions. Section 5 specifically lists certain acts carried out to protect legitimate interests, including, subject to certain conditions, the disclosure of unlawful acts or professional or other misconduct. In addition, the Whistleblower Protection Act may be relevant. Section 6 of the HinSchG governs, under certain conditions, the disclosure or revelation of trade secrets in the context of protected reports. A suspected data leak must therefore not automatically be equated with an unlawful breach of confidentiality.
The GeschGehG provides for potential civil law claims in the event of established infringements, including rectification and injunctions (Section 6), further measures under Section 7, certain rights to information under Section 8, and compensation for damages under Section 10. Which claims apply in individual cases must be assessed from a legal perspective. IT forensics merely provides the technical factual basis for this.
Where technical equipment is used for the monitoring of staff, the works council’s rights of participation, in particular under Section 87(1)(6) of the Works Constitution Act (BetrVG), may also be relevant. The specific admissibility of such measures will be clarified by the relevant internal and legal bodies prior to the investigation.
Frequently Asked Questions
Related topics
- How can you check whether an employee has uploaded company files to a private cloud account?
- How can a company clearly distinguish between whistleblowing and disclosure of confidential information in the event of a suspected data leak?
- How should a company preserve digital evidence following receipt of an internal report?
- IT Forensics for Businesses
LanCologne – IT Forensics for Businesses
Do you have a digital enquiry? LanCologne can assist you with an objective, unbiased IT forensic investigation.
Related to this topic
- How can you check whether an employee has uploaded company files to a private cloud account?
- How can a company find out whether an employee has accessed the company’s systems after being made redundant?
- How can one check whether a former employee has subsequently used company data at a competitor’s firm?
- How can a company correctly interpret MDM data in an investigation relating to employment law?