Employee Data Theft: How to Investigate a Departing Employee

When an employee who is leaving, or has just left, may have taken company data, preserve the evidence before anyone confronts the person or cleans up. Keep the laptop out of the reimaging queue, put the mailbox and OneDrive on hold before the account is deleted, and export logs that expire quickly: Microsoft Entra ID keeps sign-in logs for 30 days on P1 and P2 licenses, and a deleted Microsoft 365 mailbox is purged after 30 days unless a hold is in place. The evidence can then show what was copied to USB storage, sent to personal email, synced to personal cloud storage, printed, or uploaded to a generative AI tool, and when, compared with what is normal for the role. Forensics proves activity on company systems; it rarely proves what someone photographed with a phone. Counsel decides what to do with the findings.

What should you do in the first 48 hours?

Three routine IT tasks destroy the evidence in these cases, and each is easy to stop if someone acts early.

The first is reimaging or reissuing the laptop. A returned laptop often goes back into the pool quickly, and reimaging overwrites the USB history, file access records, browser history, and deleted-file remnants that show what happened. Pull it from circulation, have it forensically imaged, and keep the original.

The second is deleting the account or the mailbox. When a Microsoft 365 user is deleted, Microsoft Entra ID keeps the account recoverable for 30 days, and Exchange Online keeps the mailbox for 30 days, after which both are permanently deleted. Microsoft's documented way to keep the mailbox is to place a Litigation Hold before deletion, which turns it into an inactive mailbox. OneDrive retention for deleted users can be set from 30 to 3,650 days in the SharePoint admin center, so check the setting before the account goes.

The third is letting logs roll off. Entra ID sign-in logs last 30 days on P1 and P2 and 7 days on the free tier, Exchange Online message trace reaches back 90 days, and the Microsoft 365 unified audit log keeps records for 180 days on Audit (Standard). Every day of delay shortens the window you can see. Once litigation is reasonably anticipated, those losses also carry legal risk: under Federal Rule of Civil Procedure 37(e), a court can order measures to cure prejudice when a party failed to take reasonable steps to preserve electronically stored information, and the most severe sanctions follow a finding of intent to deprive the other side of it. Our litigation hold guide covers when that duty starts.

How do employees take data, and what evidence does each method leave?

Each route out leaves a different trail, and some leave almost none. The table pairs each method with where the evidence lives, what it can show, and its limits.

The USB row is the easiest to overstate. Registry entries and setup logs prove a device was connected and when. LNK files and jump lists record documents opened from a volume along with that volume's serial number, which examiners match to the device through event 1006, a method documented for Windows 10 and 11 by forensic practitioners. That chain can show that a specific document was opened from a specific removable drive. Windows does not log the copy operation by default, so a finding that files were copied rests on corroboration, such as matching file names and timestamps or an examination of the drive itself.

How can you tell if an employee took files before leaving?

Build a timeline around the notice date and compare it with what is normal for the role. CISA defines an insider threat as the threat that an insider will use authorized access, intentionally or unintentionally, to harm the organization. A departing employee who takes data is the intentional case, and because the person uses authorized access, most of the activity looks like ordinary work. A salesperson who exports the CRM every quarter is doing the job. The same export in the week before resignation, followed by a USB connection and a personal webmail session, is a pattern that needs an explanation. The baseline comes from the same person's activity in earlier months and from peers in the same role, measured in the same log sources.

The window matters as much as the method. We usually start with the 90 days before notice and extend it when the evidence points earlier, because collection can begin well before a resignation. The figure shows how much of that window each source still covers if collection waits until the last day.

The last day does not close the window. Sign-ins after departure, mail forwarding rules that keep running, OAuth grants to personal apps, and sharing links that still work all extend the timeline, and some of them are how data keeps leaving after the person is gone.

What can Microsoft 365 and Google Workspace logs show?

The cloud tenant often holds the strongest evidence. The Microsoft 365 unified audit log records SharePoint and OneDrive file activity such as FileDownloaded, FileUploaded, and FileAccessed, and Exchange activity including MailItemsAccessed and Send. Microsoft added the mail access, sent mail, and search records to Purview Audit (Standard) under its expanded logging program, so tenants on the standard tier now have them. Audit (Standard) keeps records for 180 days, and Audit (Premium) keeps Entra ID, Exchange, OneDrive, and SharePoint records for one year.

Exchange Online message trace shows the date, sender, recipient, subject, and status of messages for up to 90 days, and its enhanced report adds message size. It does not show content, which lives in the mailbox, so preserving the mailbox and running the trace go together. Google Workspace keeps Admin, Drive, Gmail, and login audit events for six months, and administrators cannot change that period in the Admin console, so a Workspace investigation that starts late has the same gaps as a Microsoft 365 investigation that starts late.

What legal options does the evidence support?

Counsel decides the legal path, and the forensic work supports it. Three bodies of law usually frame the options, and noncompete agreements add a fourth question.

The Defend Trade Secrets Act of 2016, at 18 U.S.C. 1836, gives the owner of a misappropriated trade secret a federal civil claim. Remedies include an injunction, damages for actual loss and unjust enrichment or a reasonable royalty, exemplary damages of up to two times for willful and malicious misappropriation, and attorney's fees in some cases. An injunction cannot stop someone from taking a new job, and any conditions on the new employment must rest on evidence of threatened misappropriation rather than on what the person knows, which is where forensic findings carry weight. In extraordinary circumstances a court can order an ex parte civil seizure, and suit must be filed within three years after the misappropriation was or should have been discovered. Two more provisions connect directly to evidence. Information counts as a trade secret only if the owner took reasonable measures to keep it secret, which access controls, DLP, and offboarding records help show. And under 18 U.S.C. 1833(b), an employer that left the whistleblower immunity notice out of its employee agreements cannot recover exemplary damages or attorney's fees against an employee who never received it.

The Computer Fraud and Abuse Act reaches fewer departing employees than it once did. In Van Buren v. United States (2021), the Supreme Court held that the "exceeds authorized access" clause covers people who obtain information from parts of a computer they are not entitled to enter, and that it does not cover people with an improper motive for obtaining information otherwise available to them. The Court described the test as a "gates-up-or-down inquiry," so the facts that matter are which systems the person could enter and when that access ended.

State law runs alongside the federal claims. Most states have adopted a version of the Uniform Trade Secrets Act, and New York is among the few that have not. Noncompete agreements remain a matter of state law and contract. The FTC's 2024 Non-Compete Clause Rule never took effect: a federal court set it aside in Ryan, LLC v. FTC (N.D. Tex. 2024), the FTC moved in September 2025 to dismiss its appeals, and it removed the rule from the Code of Federal Regulations on February 12, 2026. The agency now challenges specific noncompetes case by case under Section 5 of the FTC Act, as in its November 2025 final order against Gateway Services. Whether to send a demand letter, seek an injunction, or let the matter go is counsel's call, and if an examiner may later testify, counsel should plan for that early, as our guide to cybersecurity expert witnesses explains.

How do you investigate discreetly, and when should counsel lead?

Discretion protects the investigation and the people in it. Keep the circle small: the HR lead, in-house or outside counsel, one IT administrator who carries out preservation, and the examiners. Collect quietly, since a laptop can be imaged during a routine hardware refresh and logs can be exported without touching the person's mailbox. Interview after preservation, because an interview warns the person and anyone working with them. HR also has its own limits on what it can collect and share about employees, which our HR guide to employee data protection covers.

Bring counsel in before the first collection when litigation is plausible, when the person is senior or in a regulated role, or when the data includes customer personal information that could trigger notification duties. Counsel can then retain the examiners so the work supports legal advice, as our Kovel agreement guide explains, and decide what the business sees. Privilege and work product calls belong to counsel and, ultimately, the court.

How can offboarding prevent data theft and preserve evidence at the same time?

The same controls do both jobs. Start with access timing. For most departures, access ends on the last day, while for people with access to trade secrets, customer lists, or source code, HR and counsel may decide to reduce access at notice and revoke active sessions.

Microsoft Purview Endpoint DLP can audit and restrict copying protected files to USB media, uploading them to restricted cloud service domains, pasting their content into restricted sites in supported browsers, and printing them, and the restricted-domain list can include generative AI sites. Every blocked or audited attempt becomes evidence, and the controls themselves help show the reasonable measures a trade secret claim requires. Our guide to shadow AI covers how to find the AI tools employees already use.

Retention settings preserve the record. Extend OneDrive retention for deleted users, place a hold on departing employees' mailboxes so they become inactive mailboxes instead of being purged, and consider Audit (Premium) where a year of audit history matters. A Microsoft 365 security assessment checks these settings against your tenant's current configuration.

How BD Emerson runs departing-employee investigations

We run these quietly and, when litigation is likely, through counsel. The first step is a preservation plan the client's IT team can carry out the same day: which devices to pull, which holds to place, and which logs to export. Our examiners then image the laptop and any returned media, collect the mailbox, OneDrive or Google Drive, and the identity and audit logs, and build a timeline around the notice date against the person's own baseline. The report states what the evidence shows and what it cannot show, in terms counsel can use for a demand letter, a declaration, or an injunction motion.

Our practitioners have testified as expert witnesses in court. We take testifying engagements selectively; most of our litigation work is as consulting experts retained through counsel. The method and scope of this work are on our digital forensics services page.

Frequently asked questions

How can you tell if an employee copied files to a USB drive? Windows records which USB storage devices connected and when, in the registry, the setupapi.dev.log file, and the Partition/Diagnostic event log. LNK files and jump lists record documents opened from a removable volume along with the volume's serial number, which examiners match to the device. Windows does not log the copy itself by default, so a finding that files were copied rests on corroboration, such as matching file names and timestamps or an examination of the drive.

Can you see what an employee emailed to a personal account? Exchange Online message trace shows the sender, recipient, subject, and status of messages for up to 90 days, which identifies mail sent to personal addresses, and the unified audit log records Send operations. The content and attachments live in the mailbox, so preserve it before the account is deleted. A deleted Microsoft 365 mailbox is purged after 30 days unless a hold turns it into an inactive mailbox.

Should we confront an employee we suspect of taking data? Preserve the evidence first and let counsel decide when and how to talk to the person. An interview or a demand warns the employee and anyone working with them, and data on personal devices or accounts can disappear quickly. Image the laptop, place holds on the mailbox and cloud storage, and export the logs, then plan the conversation with HR and counsel using what the evidence shows.

Is it illegal for an employee to take company files? It depends on what was taken and how. Taking trade secrets can support a civil claim under the Defend Trade Secrets Act and state trade secret law, and confidentiality agreements add contract remedies. After Van Buren v. United States (2021), the Computer Fraud and Abuse Act's exceeds-authorized-access clause does not reach employees whose only wrong was an improper motive for obtaining files they were entitled to access. Counsel decides which claims the facts support.

Can you prove an employee uploaded files to ChatGPT or another AI tool? You can when a control inspected the transfer. Browser history shows visits to AI sites but does not record what was pasted or uploaded. Proving content transfer usually takes endpoint DLP rules that audit pastes and uploads to restricted domains, or a web gateway that logs uploads. If the employee used a company-managed AI account, that service's own records may also help.

How far back should a departing employee investigation look? Start with the 90 days before notice, extend the window if the evidence points earlier, and carry it past the last day to catch later sign-ins, forwarding rules, and shared links. Retention sets the practical limit: Entra ID sign-in logs keep 30 days on P1 and P2, Exchange Online message trace reaches 90 days, and the Microsoft 365 audit log keeps 180 days on Audit (Standard).

If someone has resigned and you suspect data left with them, our digital forensics team can preserve the laptop, mailbox, and cloud logs, build the timeline around the notice date, and report what the evidence shows to you or your counsel.