It is becoming common for employees who are dismissed from their jobs to file wrongful dismissal claims against their employers. Employees who leave may also be taking intellectual property information with them, in the form of computer data, to use against the company. Often they are violating non-compete agreements.
All of these can drain a company’s resources and threaten its position among competitors. Litigation on issues such as discrimination, harassment, wrongful termination, and acts of malfeasance present real
and significant threats to business continuity and resources.
The increasing costs and impact of litigation can affect the whole enterprise including human resources, legal, accounting, IT/IS, and executive management. These employees typically “delete” incriminating and/or sensitive computer files. What they don’t know is that this information may still exist in ambient storage areas on their computers This computer data may linger for months or even years and it can be recovered and documented using computer forensic methods and techniques.
By using ForenTech’s computer forensics consulting services, employers can now reduce wrongful dismissal claims. This recovered and incriminating digital evidence can prove that the employer’s computer was used in violation of policy or in the commission of computer crimes, all of which may also be used against the employee. Dismissed employee actions can also be reduced through preventative actions and policies implemented
by the employer. Computers are usually reissued when employees leave. This practice can destroy the incriminating evidence that can be used against the former employee. Also, continued use of the computer may raise questions as to who created the incriminating evidence and when.
Employee Termination Program (ETP)
An example of how we can help corporate users is with our Employee Termination Program. With this, we go on-site and use court-approved software and methodologies to create a forensic mirror image backup of all relevant hard disk drives on computers used by terminated, or soon to be, employees. Images are delivered on DVD with affidavits, pictures, and documentation. Lastly, we wipe the disk clean to DoD standards. This completely overwrites all information on the drive
and makes it ready for a new user, something every company should consider when turning over a computer.
Our full-service approach to technology forensics encompasses all phases of acquisition, authentication, analysis, reporting and presentation of forensic data.
The Nature of Electronic Data
Electronic data, and in particular e-mail communications, have a number of different attributes that make for a fertile ground for exploration in litigation.
First, increasingly many employees have access to e-mail systems. The access to e-mail communication systems opens up a whole new world of communication opportunity for company personnel. Because of
the relative ease of delivering an electronic communication, the sheer volume of statements, admissions, conflicting information, and correspondence has increased dramatically over the last five
years. This volume increases both the likelihood of a “smoking gun” type of statement and evidence of mitigating facts to explain the context of a particular communication or statement. Even for a relatively
small organization, the volume of messages sent electronically can be staggering. For example, a 1,000- person organization with each person sending eight messages per day results in two million electronic
messages annually, not taking into account redundancies and send-on messages.
Second, electronic communications often have an informality and truthfulness about them, thereby making particularly credible evidence at trial if properly authenticated and admitted. The credibility of
this evidence is derived from the perception that the guard of the e-mail writer is down and that truth often emerges when a more informal and spontaneous communication is sent.
Third, electronic communications are often accompanied by a company sanctioned-statement about the intended purpose of the communication and a “signature” tag implying that the communication is being sent on behalf of the company. These communications can be viewed as representing an official position of the company, although they may actually only represent a personal view or opinion.
Fourth, while there may be a perception that electronic communication is transitory and can be easily deleted, this perception almost always is at odds with reality. This perception gap is created by the existence of multiple copies of the electronic communication and the likelihood that it was sent on to multiple persons who themselves perhaps have multiplied the number of extant copies of the communication. This electronic proliferation creates numerous discovery opportunities for a single communication.
In addition to the natural electronic proliferation of the electronic communication, the deletion of electronic data is often difficult to accomplish. Increasingly, technology is available to recover “deleted”
documents in a manner that preserves the evidentiary integrity of the data. This reappearance propensity has been labeled “the vampire effect” of electronic data.
Finally, in many instances the company has no formalized system for organizing or retrieving electronic communications, nor does the company have policies and procedures regarding the retention of such electronic data.