Using Computer Forensics to Investigate Employee Data Theft

Using Computer Forensics to Investigate Employee Data TheftIntroductionOver 25 percent of employees steal proprietary info when departing a company or organization.1 To that end, our experience shows that departing employees have a sense of ownership over the data that they copy. Intellectual property commonly stolen includes customer lists, secret formulas, germ code, strategy documents and other trade secrets. The information is often employ against the organization when the former employee goes to work for a competitor or decides to start a bleak company. When suspicions of employee data theft arise, it is important to engage a computer forensics expert to perpetrate a theft of IP abridgment in order to continue electronic data and uncover important recite. Using specialized software, the expert can reveal digital footprints such asUSB activenessFiles recently undeterminedCloud storage usageFiles sent to personal email accountsRecently printed documentsThe results of th e analysis can provide the foundation for legal action such as a temporary restraining order, permanent injunction, subpoena of personal devices, or other judicial proceeding to prevent the misappropriation of company data.When Employee Data Theft Is SuspectedEmployee data theft occurs most frequently just prior to, or immediately after, an individuals termination or resignation from an organization. Telltale signs that an investigation is warranted include unusual bodily function by the employee, such asPlugging a personal USB thumb consider or life-threatening drive into a computerComing into work at odd hours or establishing remote desktop connections during off-hoursTransferring large amounts of data on the company networkVisiting file sharing sites like Dropbox or Google mountSending emails with attachments to personal accountsIf there are concerns that a departing employee has stolen proprietary data, then it is important to replete stairs not to delete important electron ic evidence located on his or her computer. If the computer is powered on, then leave it on, beca mapping important evidence may be stored on the computers random access repositing and could be deleted if the computer is powered off. Also, ensure the computer cannot be accessed remotely by disconnecting it from the network.If the computer is already turned off, then coiffe it in obtain storage. Furthermore, confirm the employees login credentials are dis satisfactoryd or have been changed, but do not let the IT staff reinstall the operating system or reassign the computer to another employee. Such actions could destroy or overwrite any evidence of wrongdoing. Finally, resist the temptation to take a peek at what is stored on the computer by turning it on and accessing files because this could alter the data, thereby making the investigation more complex.If the suspected employee had a company-issued cell phone, then place it in secure storage as well. Smartphones hold an abundanc e of useful information such as text messages, emails, call logs, internet activity and more. The undecomposable act of resetting the phone, however, can permanently destroy this data.IP Theft InvestigationsPreserving and Analyzing Electronic EvidenceThe first step in a theft of IP investigation is to forensically preserve the data on the employees device(s). The computer forensics expert will create chain of custody documentation, photograph the hardware, and verify the integrity of the preserved data, among other things. These steps ensure that the electronic evidence will be admissible in court.Once the data is preserved, the next step in the investigation is to perform an analysis to identify software and artifacts that may be indicative of IP theft. These areas on a typical Windows installation includeUSB activityFiles recently opened or deletedCloud storagePersonal email accountsInternet history reportPrinted documentsUSB Activity AnalysisMany of todays USB devices, such as t humb drives and external hard drives, have enough storage capacity to save an entire copy of a users hard drive. As such, they are one of the most common tools utilise to steal data. The good news is that using a USB device leaves behind a trail of digital evidence that can prove invaluable to an investigation.Analyzing a users USB activity can reveal several key facts regarding what was connected to the computer and when. In most cases, forensic experts can determine the serial subprogram and/or brand of the USB device, as well as the first and last time the device was connected to the computer. In some instances, they may also be able to verify each time a specific USB device was connected.Oftentimes, the analysis will reveal that an external USB hard drive or flash drive was connected for the first time during an employees last hebdomad of employment. While most analyses reveal a new USB connection, it is also possible that a device used throughout the duration of the suspects employment was never returned. A device such as this would likely contain numerous documents and files that were related to the employees day-to-day activities and could contain set to a competitor. If it is a requirement that employees return company-owned USB drives at the end of their employment, forensic experts have the ability to verify whether or not that policy was upheld.Files Recently receptiveWhile confirming that a USB device was connected to a computer is significant, it is even more important to know what files were accessed and potentially transferred to the device. The Microsoft Windows operating system creates conglomerate artifacts when a user opens a file or tract. These artifacts indicate what was opened, when it was opened and where it was opened from. A classic red flag is if the employee was opening files during the last week of employment that were not related to the work being performing during that time.Another consideration is the organizations data acc ess policy. If data access restrictions are not in place, then the employee may be able to access company files unrelated to current work that are stored on the network. The existence of these artifacts when combined with a USB activity timeline can indicate a high probability that data was copied off the system.Lastly, the artifacts can also contain specific information about where the file existed. If a file was opened from a USB drive, the artifact will indicate this, providing factual evidence that the suspect is in possession of a USB drive that contains specific files. For example, combination a USB analysis and files recently opened analysis could show that on October 7, 2016, at 72208 a.m., a non-company-issued SanDisk thumb drive with serial number 851450 was plugged into the computer for the first time and a file titled Client Contact List.xlsx was opened.Cloud StorageIf the analysis shows that certain files were accessed but no USB activity was detected, the next step in the investigation is to identify evidence that a obliterate storage provider such as Dropbox, Google Drive or Microsoft OneDrive was accessed. The purpose of these applications is to share and sync data across multiple computers. For example, Dropbox may have been surreptitiously installed on the employees work computer as well as his or her base computer. Consequently, the simple act of syncing a company file to Dropbox will instantaneously also make that file available on the employees home computer.The good news is that cloud storage applications often have corresponding log files and databases that record what files the user accesses and what activities are performed. These logs can signify files have been uploaded to the cloud in the past even if they have already been deleted from the shared folder. Some of these applications even save deleted data in a separate hidden folder on the computer itself that users typically are not aware of. As a result, a theft of IP analysis m ay show that Dropbox was installed on the users work computer and that early in the morning on October 7, 2016, fifty files were deleted and the hidden folder reveals these were company files.Personal Email AccountsSome individuals may use their company email to send attachments to their personal email account such as Yahoo or Gmail. In these cases, forensic experts are able to perform a preservation of the employees work email to identify and document the evidence of misconduct.Internet History ReportAn Internet history report can be generated that shows, inter alia, recent Internet searches, web sites and pages visited, cookies from websites, and Internet downloads that occurred. Such information is helpful in establishing what an individual thought was important or even their fix of mind. For example, analysts have discovered that individuals have searched on how to delete data or copy data surreptitiously and that they reviewed websites that were in essence how to manuals to pe rform certain mischievous acts.Paper DocumentsFinally, individuals who are a little less aware of more modern techniques to copy data will simply print the documents they wish to take out the door. In these cases, forensic experts are able determine the last known print date of Microsoft Office documents.Deliverables and Project TimeframeThe turnaround time for a theft of IP analysis performed by an analyst is typically one week. Deliverables provided will be easy to understand in the form of spreadsheets, html reports, and pen reports containing the findings of the analysis. A forensic expert should also spend time with the client either over the phone or in person to discuss the reports in detail so that they know exactly what a report contains and the assumptions and opinions of the forensic expert. If necessary, an expert will also provide depositions or expert witness deposition regarding the authenticity of the evidence and their findings.AuthorsTimothy M. Opsitnick, Presid ent, JURINNOV, LLC, Joseph M. Anguilano, Director of Operations, and Trevor B. Tucker, Forensic Analyst. JURINNOV, LLC, a wholly-owned subsidiary of Technology Concepts Design, Inc. (TCDI), is a technology company that provides cybersecurity and eDiscovery services. Cybersecurity consulting includes investigating accidental or venomed data breaches as well as providing security strategies and assessments to prevent such occurrences. eDiscovery consulting includes computer forensic investigations and ASP ESI hosting. JurInnov news and information is available at www.jurinnov.com.For over 25 years, TCDI has been providing technology solutions through partnerships with large corporations and law firms. These solutions include advanced litigation support software and services for electronic discovery, hosted review and production, and large-scale litigation case file management. TCDI news and information is available at www.tcdi.com.1 Biscom, Employee Departure Creates Gaping Security Hole Says New Data, December 23, 2015 https//www.biscom.com/employee-departure-creates-gaping-security-hole-says-new-data/.