Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Suspected data theft by an insider

The evidence in these cases is more often about intent than about volume, and it is the case type most likely to end up in front of somebody who will test how it was collected.

Trigger. A resignation with unusual file access, a DLP alert, or an unexplained large transfer.

The first 60 minutes1 of 4 expire
030 min60
  1. 01

    Involve HR and legal before collecting anything

    by 10 min

    Not after. Employee monitoring has legal constraints that vary by jurisdiction, and evidence collected outside them may be unusable and may itself be a problem.

  2. 02

    Image, do not browse

    by 30 min

    Write-block, image, work on the copy. Record who held the device and when. This costs an hour and is the difference between findings that survive challenge and findings that do not.