1. Employee Data Theft Is Often Spread Across Systems
In older cases, evidence may have lived mostly on a company desktop. Today, relevant activity may appear across a laptop, Microsoft 365, OneDrive, SharePoint, Teams, USB devices, browser history, remote access logs, and personal email.
Common Scenarios
Common concerns include employees copying client lists, downloading project files, emailing documents to personal accounts, syncing folders to personal devices, accessing files after termination, or deleting information before leaving.
Local and Cloud Evidence Both Matter
A local device may show recently opened files, downloads, USB activity, or cloud sync folders. Microsoft 365 may show sign-ins, file access, mailbox activity, OneDrive downloads, SharePoint activity, and Teams communications.
Timing Is Critical
The most important activity often happens in the days or weeks before resignation, termination, or a known dispute.
2. Evidence That Usually Matters
File Activity
Relevant file activity may include recently opened files, downloads, modified documents, file copies, deleted files, renamed folders, compressed archives, temporary files, and cloud sync activity.
Transfer Indicators
Possible transfer indicators may include USB device connections, external drive activity, personal email attachments, cloud uploads, OneDrive or SharePoint downloads, browser downloads, and remote access tools.
Communication Evidence
Email, Teams messages, shared links, calendar entries, and vendor or client communications may help explain why certain files were accessed.
3. The Device Should Be Preserved Before Reuse
Why Reuse Is Risky
Normal use can overwrite deleted data, change timestamps, clear browser artifacts, alter recently used file lists, update cloud sync records, and create confusion about who performed which activity.
Preservation Options
Depending on the case, preservation may involve a forensic image, targeted collection, mailbox preservation, cloud log export, or specific review of folders and files relevant to the dispute.
Keep Access Controlled
Limit who handles the device or account while the matter is being evaluated. Multiple people searching through a device can create unnecessary changes and complicate later review.
4. Microsoft 365 and Cloud Storage Are Often Central
OneDrive
OneDrive may show synced folders, file downloads, deleted files, personal device access, shared links, and files copied into or out of cloud storage.
SharePoint
SharePoint may contain department or client files. Relevant records may include document access, downloads, external sharing, permission changes, deleted files, and unusual activity before departure.
Email and Teams
Email and Teams may show attachments, shared links, instructions, client communications, or evidence that helps explain whether access was normal business activity or something else.
5. Be Careful With Conclusions
Opportunity Is Not Proof
A USB device connection may show opportunity. It does not automatically prove specific files were copied.
Downloads Need Context
A file download may be normal business activity, a migration, a sync operation, or suspicious behavior.
Corroboration Matters
Stronger findings often combine local artifacts, cloud logs, file metadata, communication records, account activity, and business context.
When to Contact Cal Valley Technology Group
Contact Cal Valley Technology Group if you suspect company files were copied, emailed, downloaded, synced, deleted, or accessed after departure.