Human resource incidents: How digital forensics can help you uncover the facts
What if one of your employees visits the HR department with allegations that a colleague sent them offensive e-mails? What if the suspected employee deleted certain files from their computer? What would you do? Suspected employee misconduct is sometimes not fully investigated to verify any allegations so it is important you understand the nature of IT evidence. With digital forensics, you can these deleted files and make decisions based on facts.
Simply browsing an employee’s computer will sometimes not be sufficient to uncover the real facts in a case. Whenever computers or similar electronic devices are involved, follow chain of custody procedures during an employee investigation:
- Ensure the original evidence is never analysed or tampered with, and
- In addition, secure it in a forensics manner because, in most cases, you must use a forensic copy of the original evidence in an investigation.
This is a necessity – not an option – because if the matter goes to court and your evidence is not forensically compliant you won’t be able to use it.
Even the most careful and articulate employee will leave a trail; the key is to collect and keep this information, and then identify the suspect’s IT-related activities that will establish facts and a timeline so you can prove the allegations.
