Employers · digital evidence in employment matters
At work, most employees use Windows and cloud services, which make their own records, and these records remain long after any cleaning up; e.g., syncing an employee account to a personal email address, attaching a drive late on a Friday, returning a computer to an employer with an unusually clean Downloads folder. This process begins with securing the computer, creating an evidentiary copy of the data on the computer, and concludes with a document prepared for HR or your solicitor to act on.
Go through it with an engineer
0800 6890668
| What's needed | What it requires of you | How the bench applies it |
|---|---|---|
| Data protection law: UK GDPR & DPA 2018 | Owning the device does not automatically provide the justification for conducting an investigation into alleged misconduct: an investigation requires a lawful basis (normally legitimate interests), which must be documented in writing and proportionate to the purpose of the investigation | The scope of this is limited to the belief of wrongdoing itself, no further than that |
| Monitoring workers: guidance from the ICO (October 2023) | All monitoring should be transparent by default; use a DPIA if the risk is high | We will examine your employee monitoring and acceptable use policies before deciding whether a DPIA is required |
| Investigating without prior warning | Only justified in extreme cases (e.g. suspected criminal behaviour and gross misconduct) and only after receiving senior approval for it | There is no imaging or reading of anything until you have written approval from the appropriate person |
| This is what ACAS expect of you | Any disciplinary action taken against someone has to follow a fair and proportionate investigation into their alleged wrongdoing | Our reports are independent. Therefore our results will go out as we found them |
| Tribunal treatment | Material is assessed in terms of how it was gathered (i.e., where it came from), which bears on what it may be worth | A continuity record which supports your case rather than creating further controversy |
All instructions commence in confidence. First outline the incident, the devices and accounts involved in the incident and what the evidence needs to prove; this establishes the scope, and once established, it also sets the single written quote you will be provided prior to any examination commencing. The scoping discussion is free.
Evidence is destroyed first by one of three things: a computer being reimaged ready for use by the next user, a hard drive being returned to inventory, or a supervisor taking a quiet glance. An imaging operation using a hardware write blocker, within days, will stay ahead of all three.
All subsequent activity is retrieved from the image, never directly from the original. This includes activity related to USB devices and when those devices were connected to computers; files that have been synchronised to a user's personal cloud storage account or sent via webmail; evidence of file deletion; and whether a wipe program has been run. This is presented as one timeline.
Written for a non-examiner audience (e.g. an HR panel, solicitor, tribunal), this report demonstrates how the examination process meets the ICO's 2023 guidance on monitoring and the fairness expectations of an investigation as outlined by ACAS. The document can be used without modification by Thames Valley Police.
When all aspects of the case are handed over to another entity (report, exhibits, source files, hash values, continuity log and bench notes), a tribunal, or another expert who has been instructed against you, may replicate the work and obtain the same result(s).
The statistic that holds up: in 2013, Symantec and the Ponemon Institute reported that approximately half of departing employees admitted to taking some type of proprietary information away when they were leaving their last job. Since that time many statistics have been published by vendors; however, the numbers vary greatly. The bench offers something less quotable: in cases where employers arrive with a particular suspicion regarding the departing employee, the supporting artefacts usually exist.
The files being uploaded ceased twenty days prior to receipt of the employee's resignation letter, which is why the sequence was so obvious: the documents were all pulled into one place, access to a personal cloud account was made available, followed by the actual upload. An employer from Henley-on-Thames had only its competitor's presentation deck to go on. The case closed on undertakings.
It generally is acceptable, if two conditions are met: a lawful basis for conducting the examination, and having notified the employees beforehand that their devices may be reviewed, which is exactly what an acceptable-use policy was created for. Covert review is the exception, typically used only when an organisation suspects criminal activity and authorisation from senior management has been obtained.
Not usually, and certainly not routinely. In October 2023 the ICO issued guidance that only allows it in rare cases (suspected criminal activity is the typical example), and even then only with proper approval from someone senior, a narrowly defined scope and a documented explanation.
Preserve data prior to examining it. Securely locate your computer in an area that will be free from unauthorised access. Leave all of your email (and other) mailboxes and cloud based storage systems active. Have a forensic image created prior to opening any folders on your computer. Even a well-meant browse through it may overwrite the timestamp information that shows what was copied out.
The value of both content and process is evaluated together: what the material shows counts for less where the way it was gathered is open to attack. Therefore, screenshots will generally not carry as much weight unless there has been a valid legal justification for creating them, the scope of the review was kept proportionate, and there is sufficient documentation to support that chain of custody existed throughout the process.
Recording in a loop is already overwriting your needed evidence, and the deadline will not move. There is no cost associated with opening a case today: diagnoses are free and remain completely confidential.