IT Forensics · Business

How should a company preserve digital evidence following receipt of an internal report?

Following an internal report – for example, regarding fraud, data leaks or compliance breaches – the first few days are crucial in determining whether the relevant data will still be available later on. Automatic deletion schedules, account deactivation upon leaving the organisation or changing devices can destroy evidence before anyone has a chance to look for it.

Enquire without obligation

Why this question is important for a business

Internal investigations can have significant financial, personnel and legal consequences. This is precisely why it must first be clarified which specific technical fact is to be proven or disproved. The sheer volume of data is not an indicator of quality; what is crucial is that the investigation is appropriate, limited in scope and transparent.

Technical background

Many systems delete data automatically: Microsoft 365 in accordance with retention policies; logs after a period ranging from days to months (depending on the licence and configuration); and mobile devices are wiped when returned. A timely legal hold and targeted backup prevent this from happening, without the data being analysed immediately.

Relevant evidence and data sources

• Mailboxes and OneDrive/SharePoint (litigation/retention hold)
• Microsoft 365 Unified Audit Log, Entra ID logins
• Work devices (laptops, smartphones) before they are returned or reinstalled
• Server, VPN and proxy logs
• ERP/accounting logs, where relevant

Borders

• Data that has already been deleted can only be partially recovered.
• Private devices and accounts are not covered in the absence of a legal basis.

Possible results

• Secure, documented data set
• An overview of which sources were available and which were missing

Why LanCologne?

Internal investigations are particularly sensitive because they may simultaneously involve the company’s commercial interests, employees’ personal rights, data protection, employee participation in company affairs and potential future legal proceedings. LanCologne therefore does not begin with the most extensive possible search of the IT systems.

Here’s how we do it

• Clarification of the legal basis and involvement of the data protection officer and the works council.
• Immediate storage measures for short-lived sources.
• Forensic backup using hash values and documentation; analysis to be carried out only once the scope of the investigation has been defined.

No prejudgement – even where suspicions have already been confirmed internally

A company may already have clear grounds for suspicion for organisational or legal reasons. However, the outcome of the technical investigation remains open. We also document any findings that contradict the suspicion and explicitly state when an alleged act cannot be proven on the basis of the data obtained.

Technical findings and legal assessment remain separate

IT forensics can, for example, establish that a particular account exported a file, that a device was connected at a specific time, or that a message was technically transmitted. This does not automatically reveal which individual was responsible, whether the action was authorised, or what the consequences might be under employment, civil or criminal law.

LanCologne as an independent technical support service for the legal department and senior management

LanCologne is not commissioned to technically confirm a desired outcome. We are commissioned to provide an objective answer to a specific question of evidence based on the available digital traces. The investigation must remain verifiable even if it is subsequently scrutinised by an opposing party, a court or another qualified IT forensic expert.

Section 26 of the Federal Data Protection Act (BDSG) is a key legal reference point for employees’ data. Section 26(1) of the BDSG permits the processing of personal data relating to employees for the purposes of the employment relationship, subject to the conditions set out therein. With regard to the detection of criminal offences, the provision requires, in particular, that there be documented factual indications, as well as that the processing be necessary and proportionate; the employee’s legitimate interest must not take precedence. Section 26(6) of the BDSG leaves the participation rights of employee representative bodies unaffected.

In addition, the principles of the GDPR apply, in particular lawfulness, purpose limitation and data minimisation under Article 5, as well as the requirement for a valid legal basis under Article 6. In the case of special categories of personal data, Article 9 of the GDPR and, where applicable, Section 26(3) of the BDSG must also be observed.

In the case of technical equipment intended to monitor the behaviour or performance of employees, Section 87(1)(6) of the Works Constitution Act (BetrVG) provides for a right of co-determination for the works council, insofar as there are no statutory or collective agreement provisions in place. For MDM, EDR, DLP, logging and similar systems, the specific design of each must therefore be taken into account.

In the case of reports made under the Whistleblower Protection Act, Section 8 of the HinSchG is particularly relevant. The duty of confidentiality protects not only the identity of the whistleblower, but also the persons who are the subject of a report and any other persons named in the report. Section 9 of the HinSchG sets out statutory exceptions to the duty of confidentiality. Section 36 of the HinSchG prohibits reprisals and, subject to the conditions set out therein, contains a rule on the burden of proof.

In the case of trade secrets, an internal investigation must not automatically treat a report as a breach of confidentiality. Section 5 of the Trade Secrets Act (GeschGehG) sets out exceptions to the prohibitions in Section 4, including, amongst other things, under certain conditions for the detection of unlawful acts or professional or other misconduct, as well as for necessary disclosures to employee representatives.

Should civil proceedings arise at a later stage, the Code of Civil Procedure (ZPO) provides, amongst other things, for evidence by inspection; Section 371(1) ZPO expressly governs the case where an electronic document forms the subject matter of the evidence. Sections 402 et seq. ZPO apply to expert evidence. In criminal proceedings, the court determines the scope of the taking of evidence in accordance with the Code of Criminal Procedure (StPO); in particular, Section 244 of the StPO governs the principle of investigation and applications for evidence. However, these procedural provisions do not automatically transform a privately commissioned IT forensic report into a court expert report.

LanCologne provides technical expert services and does not offer legal advice. The specific admissibility of an investigative measure, the consequences under employment law, procedural strategy and criminal law assessment remain the responsibility of the relevant legal advisers, authorities and courts.

Frequently Asked Questions

🔗 Related topics