When an employee with critical access leaves: how to preserve digital evidence
Many disputes with former employees are lost for a simple reason: by the time the company wants to check what happened, the evidence no longer exists. Devices have been wiped for reuse and cloud logs have expired.
On the day they leave
- Revoke all access: email, VPN, cloud apps, admin accounts and shared passwords.
- Collect phones, tablets and laptops and do not wipe or reassign them.
- Store them sealed and record who holds them and since when (chain of custody).
In the first few days
- Export the cloud audit logs (for example Microsoft 365): they are kept for a limited time.
- Check whether files, emails or shared folders have been deleted: some can only be recovered within a short window.
- Review the antivirus and device management consoles.
What an expert report can show
- Whether and when a device was factory reset.
- How many files were deleted from a computer and which programs were uninstalled.
- Which cloud content was deleted, when and from which IP address.
The sooner you act, the more evidence survives. An expert can carry out a forensic acquisition of the devices before anyone else touches them.