- Nationwide Digital Forensic & Cyber Investigation Services
Insider data theft cases hinge on evidence that decays fast: USB device history, personal cloud sync logs, and webmail forwarding rules. This page explains what that evidence looks like, what claims it supports, and why preservation has to start before the exit interview, not after.
| Question | One line answer |
|---|---|
| What is the first thing to do when theft is suspected? | Issue a litigation hold and image the device before it is reissued, wiped, or returned to a leasing pool. |
| Can we prove a USB drive was used? | Often yes, through registry and event log artifacts identifying the device, though the drive itself is usually not recoverable unless seized. |
| Does forwarding company email to a personal account count as theft? | It can be strong evidence of misappropriation, particularly when combined with access to files outside normal job duties. |
| Can we sue under the CFAA? | It depends heavily on the facts. After Van Buren, exceeding authorized use of data one is otherwise permitted to access is a much narrower theory than before. |
| What about a civil trade secret claim? | The Defend Trade Secrets Act provides a federal civil cause of action when the taken information qualifies as a trade secret and reasonable protective measures existed. |
| Is this a police matter? | It can be, particularly with clear unauthorized access, but many insider cases proceed as civil litigation rather than criminal referral. |
| Term | What it means |
|---|---|
| Insider threat | A current or former employee, contractor, or business partner who misuses legitimate or residual access to take, damage, or expose an organization's data or systems. |
| Exfiltration vector | The specific method used to move data out of the organization, such as USB storage, personal cloud sync, webmail, or a messaging application. |
| Litigation hold | A directive to preserve documents and electronic evidence relevant to anticipated or pending litigation, issued to prevent spoliation. |
| Trade secret | Information that derives independent economic value from not being generally known and is subject to reasonable measures to keep it secret, as defined under the DTSA. |
| Authorized access | Under the CFAA post Van Buren, whether a person had permission to access a particular file or system, not merely whether they misused information they were otherwise entitled to view. |
| Deleted file recovery | Forensic reconstruction of files an employee attempted to delete before returning or losing access to a device, which is frequently possible when the device is imaged promptly. |
Insider cases are won or lost on artifact level detail. A general statement that an employee "took files" rarely survives scrutiny; a specific finding that a named file was copied to a specific USB device at a specific timestamp, then a directory of similar files was deleted, is a very different piece of evidence.
Windows registry keys and event logs, and macOS system logs, record the vendor, serial number, and first and last connection times of removable storage devices, even after the device itself is gone.
Dropbox, Google Drive, OneDrive personal, and similar applications leave local database and log artifacts showing which folders were synced and when, often even after the application is uninstalled.
Corporate mail server logs and, where available, browser history, can show access to personal webmail from a company device and any forwarding rules configured on the corporate mailbox.
Metadata showing when files were opened, copied, renamed, or moved, particularly in a burst shortly before resignation or termination.
Uploads to file sharing services, competitor job application activity, and searches related to data transfer methods are all frequently recoverable.
Print spool artifacts and file server access logs that show bulk access to directories outside an employee's normal responsibilities.
Most of this evidence is recoverable only if the device is imaged before it is reissued or the account is deprovisioned in a way that purges logs. Once a laptop is wiped for the next hire, or a cloud account's activity logs age past their retention window, the specific artifacts described above are often permanently gone.
Two federal statutes come up repeatedly in insider theft matters, and they work very differently.
| Statute | Type of claim | Key requirement |
|---|---|---|
| Defend Trade Secrets Act | Federal civil cause of action | The information must qualify as a trade secret, meaning it has independent economic value from secrecy and was subject to reasonable protective measures |
| Computer Fraud and Abuse Act | Civil and criminal, narrower after Van Buren | Requires accessing a computer or specific files or areas without authorization; misusing information one was authorized to view generally does not qualify after Van Buren v. United States |
Before Van Buren v. United States, some courts allowed CFAA claims against employees who accessed information they were technically permitted to view but used for an improper purpose. The Supreme Court rejected that theory, holding that CFAA liability generally requires accessing files or systems the person had no permission to access at all, not merely misusing information they were otherwise entitled to see. This significantly narrowed CFAA exposure for classic insider misuse scenarios and pushed many cases toward DTSA and state trade secret law instead.
We image devices and preserve cloud account activity before the window closes, and package findings for counsel building a DTSA or state trade secret claim.
The single most common mistake in insider cases is delay. HR processes, IT reissue schedules, and a desire to avoid confrontation all push toward returning a departing employee's device to circulation before anyone thinks to image it.
The moment theft is suspected, issue a litigation hold covering the employee's device, email account, cloud storage account, and any shared drives they had access to.
Physically secure the device rather than reissuing it, and disable but do not delete associated accounts.
Engage an independent examiner to create a forensic image of the device and export relevant cloud account activity logs before retention windows close.
Preserve corporate email server logs covering forwarding rule changes and any webmail access from company systems.
Document the chain of custody from the moment the device was secured, since the employee's counsel will likely challenge the collection process if litigation follows.
A defensible preservation record matters as much as the underlying artifacts. A court asked to award relief under the DTSA or to issue a temporary restraining order will want to see that the evidence was collected properly and promptly, not assembled after the fact from secondhand recollection.
Deleted files and their metadata are frequently recoverable through forensic imaging, especially when the device is preserved quickly.
After Van Buren, CFAA claims generally require access without authorization to the specific files or systems, not merely misuse of information the employee could otherwise see.
We cannot access the personal account itself, but corporate systems often retain evidence of what was sent to it, and civil discovery can compel further disclosure.
Insider theft cases involving sales lists, source code, or customer data occur across all levels of an organization and are evaluated on the evidence, not the title.
We are engaged by employers and by outside counsel to investigate suspected insider data theft with the discipline litigation requires: forensic imaging, cloud account preservation, artifact analysis, and reporting built to support a DTSA claim, a state trade secret action, or, where the facts support it, a referral to law enforcement.
Same day forensic imaging of a departing employee laptop or phone before it is reissued or wiped.
Identification of removable media and personal cloud application activity tied to specific files and timestamps.
Review of corporate mail server logs for forwarding rule changes and personal webmail access from company systems.
Reconstruction of files an employee attempted to remove before departure, where the device was preserved in time.
Findings organized against the elements of a DTSA or state trade secret claim, ready for counsel and for use in seeking injunctive relief.
Court qualified examiners available to testify about methodology and findings in depositions and at trial.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
As soon as possible, ideally the same day suspicion arises. USB history, cloud sync artifacts, and deleted file remnants degrade quickly once a device is reissued, wiped, or left in normal use by another employee.
Often yes. Windows and macOS both retain artifacts identifying connected removable storage devices, including vendor and serial number information, even though the files copied to the drive itself are usually not recoverable unless the drive is seized.
The DTSA is a federal civil cause of action focused on whether taken information qualifies as a trade secret. The CFAA addresses unauthorized computer access and, after the Supreme Court decision in Van Buren, generally requires access to files or systems the person had no permission to access at all, which is a narrower standard than simply misusing information.
It is strong supporting evidence, especially combined with access to files outside the employee's normal duties, but the full picture usually requires correlating mail server logs, file access records, and device artifacts together.
It depends on the facts and on counsel's strategy. Many insider theft cases proceed as civil litigation seeking injunctive relief and damages, while cases involving clear unauthorized computer access may also support a law enforcement referral.
Deleted files, browsing history, and application artifacts are frequently recoverable through forensic imaging even after deletion, provided the device has not been reissued, reformatted, or heavily used since the relevant activity occurred.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder