Preserving digital evidence - Image first, ask questions later

A senior employee left your company six months ago. Now there's suspicion that she misused IP. But someone else in the company is now using the computer she'd had.

This is a common scenario. Many investigations happen long after the event.

A computer may be a silent witness to a crime. Everything done on it leaves a trail. Timely preservation is the key. The moment someone else uses the computer, things change: dates and times are updated and files are overwritten.

Digital evidence is volatile and subject to deliberate or accidental destruction. But deliberate deletion of files and emptying of the recycle bin do not, in fact, destroy the files. Timely action can recover them. The longer the delay and the more the computer is being used, the more likely it is that the deleted data will be overwritten.