1. © 2015 Grant Thornton UK LLP. All rights reserved.
Shutting the digital
gate – data
preservation and HR
Background
Internal departments such as HR, IT and legal teams, regardless
of the company business sector should consider implementing a
legal hold on electronic data when key employees leave their
employment as part of their wider information governance
programme. A targeted approach whether on an individual or
department basis should and can be considered depending on
the allegations.
From subject access requests and disgruntled employees
through to resource intensive internal investigations for
potential IP theft and regulatory responses, the impact and
effect of not having key ex-employees’ data readily to hand can
be both reputational and financial.
HR and legal departments potentially have the most to gain
from forensic technologies, given that HR management is often
charged with policy enforcement as well as monitoring and
resolving employee or management complaints. Having all of
the relevant information gathered into an easy to understand
report helps HR managers and legal teams to quickly resolve
problems and take action if required. The gathered information
can also be used to exonerate employees, businesses or
contractors from policy breaches and 3rd party actions.
Digital forensics is becoming more prevalent in the civil arena. High
profile criminal cases as seen with the News International phone hacking
scandals have highlighted the importance in both preserving and seizing
electronic data.
But what if it isn't a criminal investigation?
Scale of the problem
You may be asking why this is important, and can we legally do
this? This paper will help you realise the benefits and how
simple steps taken may prevent potential legal issues arising well
after an employee has exited a company and provide your
organisation with assurance and protection from any potential
surprises.
The scale and impact of internal investigations, fraud, litigation
or regulatory enquiries will of course vary subject to the nature
of the issues and nature of the parties involved however any
event will demand time, internal resources and can have
significant financial impacts.
Listed below are examples of some instances whereby HR and
legal teams may wish to consider digital forensic assistance. Do
any of these scenarios sound familiar to you or your team?
- Allegations of Intellectual Property Theft i.e. company
confidential data such as client lists, procedures, pending
patents that could be stolen by an employee
- Social media misuse or accessing inappropriate material
outside of the company IT policy
- Abuse aimed at discrediting their employer or colleague
- Fiddling expenses or fraudulent activity
- Harassment or bullying
- Breach of contract
- Sending inappropriate jokes via the company email systems

2. How the Digital Forensic Group can assist you
You may be surprised that company property in the form of
smart phones, tablets, laptop, desktop PC, memory sticks and
company server data could help with any internal investigation.
Grant Thornton’s Digital Forensic Group are able to deploy
techniques used to forensically capture these everyday electronic
devices that can be preserved and analysed to court standards,
using industry recognised forensic tools. This means
inappropriate or illegal activity can be permissible evidence at
any employment tribunal or handed to local law enforcement
agencies if allegations are thought to be of a criminal offence.
A trained digital forensic practitioner should be called for advice
or to assist in the process, and this is where we can help you.
We will be able to use recognised standard operating procedures
and specialist forensic tools used by law enforcement agencies
to:
- Initiate chain of custody to preserve the electronic data to
ensure the integrity and process is documented.
- Forensically preserve data, so that the electronic device can be
examined in further detail without accessing the original media.
- Recover deleted data from mobile devices and computers,
where an employee may have tried to cover their tracks.
- Identify confidential data that may have been copied onto
removable media such as memory sticks.
- Gain insight into the use of the electronic device to determine
time lines to employee activity of generated data.
Even if a model employee has left your company, you may wish
to consider forensically capturing all their work related data
from company issued mobile devices, memory sticks, laptops,
computers, or data stored on shared drives of servers. This
would allow vital documents to be recovered with the
knowledge the original files were not tampered with and
without any loss of information.
Furthermore, if it came to light some months later that any
former member of your staff was involved in something
inappropriate at the time of employment, their company related
data would be preserved allowing the information to be
scrutinised and investigated further. This is with the
understanding that the forensically captured data would not
have changed in the process.
Additional Benefits of a Legal Hold
Following creation of any forensic image, the snap-shot in time
is preserved. If after an employee has left employment and
issues subsequently come to light the forensic image can be
analysed further at any point in time, so determine and ascertain
any truth or evidence stored on the device or how it was used
by the former employee.
The benefits of forensically capturing employee data of exit are
numerous including:
- Empowering HR investigations
- Reducing legal liabilities
- Reducing investigative costs and time
We can also provide you with the secure deletion of data from
hard drives which provides assurances that you will not have
succumbed to breaking any laws such as the Data Protection
Act whereby data should be used fairly, lawfully and kept no
longer than is absolutely necessary in a secure environment.
Can I Use My Own IT Team?
The Digital Forensic Group are independent and can provide
both impartial advice as well as assurance to employees on all
work performed.
Your IT team will be fully trained and have extensive
experience in this sector, however the background to
performing or scoping work that may involve potential litigation
or criminal investigations may not be part of their experience.
Furthermore, specialist forensic software and hardware, along
with a variety of forensic techniques may not be in their
possession or remit for their current position. This is where we
can add value to your company, using our specialised forensic
training and experience.
We are flexible on costs, and a quote can be provided on a case
by case basis once we understand your requirements.
Bruce Keeble
Senior Consultant, Digital Forensics Group
T +44 (0)20 7865 2470
E bruce.h.keeble@uk.gt.com
Suki Pooni
Specialist Consultant, Forensic and Investigation Services
T +44 (0)207 865 2271
E suki.s.pooni@uk.gt.com