IT Forensics · Business

How can an internal IT forensic investigation be carried out in a way that remains open-ended?

Internal investigations often begin with a suspicion directed at a specific individual. If the forensic analysis is then focused solely on confirming this suspicion, blind spots arise – and a report that is open to challenge in court or by the authorities.

Enquire without obligation

Why this question is important for a business

In the case of internal incidents, commercial interests, the preservation of evidence and employees’ rights may all be affected simultaneously. A technically wide-ranging investigation is therefore not automatically a good one. What is crucial is a clearly defined question of evidence and a transparently limited scope of the investigation.

Technical background

Open-endedness must be ensured through methodological measures: neutral wording of questions, explicit consideration of alternative explanations (e.g. shared accounts, remote access, automated processes) and equal emphasis on the documentation of exculpatory findings.

Relevant evidence and data sources

• Depending on the allegation; additionally, look for clues that suggest other possibilities: meetings, remote access, shared accounts, automatic synchronisation

Borders

• Assigning an account to a natural person requires additional supporting documents.
• Not all alternative hypotheses can be conclusively tested using the available data.

Possible results

• Confirmed, refuted and outstanding issues – shown separately
• Comprehensive documentation for future audit purposes

Why LanCologne?

Internal investigations involve a direct clash of several interests: the company must be able to protect its systems, data, trade secrets and commercial interests. At the same time, employee data protection, proportionality, co-determination and, where applicable, the protection of private data must be observed.

Here’s how we do it

• Formulate the question in a neutral way („Was X carried out from account Y?“ rather than „Prove that person Z …“).
• Record counter-hypotheses and test them systematically.
• Document findings with supporting evidence, even if they exonerate the patient.

No prejudgement of employees

An internal suspicion is not simply declared to be the outcome of the investigation. We examine which technical facts support it, which contradict it, and what alternative explanations exist. Even a finding that is unfavourable to the company or exonerates it is fully documented.

Comprehensible to senior management and the legal department – reproducible for forensic experts

The main body explains the key message without using unnecessary technical jargon. The technical section documents data sources, backup statuses, identifiers, integrity information, time references, artefact locations and validation steps. This ensures that the investigation remains traceable for subsequent technical cross-checking.

LanCologne: independent technical support for businesses

Where an internal incident requires technical investigation, LanCologne provides support in the form of an objective, unbiased and transparent IT forensic investigation. The focus is not on a desired outcome, but solely on what can actually be substantiated on the basis of the digital evidence within the permissible scope of the investigation.

In Germany, Section 26 of the Federal Data Protection Act (BDSG) must be observed in particular with regard to employees’ data. Personal data relating to employees may be processed for the purposes of the employment relationship if this is necessary for the purposes specified therein. Section 26(1) of the BDSG sets out specific conditions for the detection of criminal offences: There must be documented factual grounds justifying the suspicion that the data subject has committed a criminal offence in the course of their employment; the processing must be necessary for the detection of the offence, and the employee’s legitimate interests must not outweigh this. In particular, the nature and extent of the processing must not be disproportionate.

In addition, the general principles of the GDPR apply. Article 5 of the GDPR requires, amongst other things, lawfulness, purpose limitation and data minimisation. Article 6 of the GDPR requires a valid legal basis for processing. Consequently, the fact that an analysis is technically feasible does not automatically mean that it is legally permissible.

In the case of technical equipment, Section 87(1)(6) of the Works Constitution Act (BetrVG) may also be relevant. According to this provision, in the absence of any statutory or collective agreement provisions, the works council has the right to be consulted on the introduction and use of technical systems designed to monitor employees’ behaviour or performance. Depending on their design, this may be relevant, for example, in the case of MDM, EDR, DLP, logging or other monitoring systems.

Section 26(6) of the Federal Data Protection Act (BDSG) expressly clarifies that the participation rights of employees’ representative bodies remain unaffected. The specific admissibility of an investigative measure under labour law and works constitution law should therefore, where employees are concerned, be clarified with the relevant legal advisers and, where appropriate, the designated company bodies before it is carried out.

LanCologne does not replace this legal assessment. Our task is, once the permissible scope of the investigation has been defined, to examine the technical question of evidence in a transparent, proportionate and unbiased manner.

Frequently Asked Questions

🔗 Related topics