When staff leave, data has a habit of leaving with them.

The leaver pattern, evidenced

Most employee-exfiltration matters follow a recognisable arc: an intention formed, a collection phase, and a transfer in the final days. The evidence sits across the company laptop, the mailbox, the cloud tenancy and sometimes a phone: mass downloads, first-seen USB devices, uploads to personal storage, forwarding rules, and files renamed to travel quietly. We reconstruct that arc with timestamps and hashes, and report it in a form that supports whatever follows: an HR process, an injunction, or a negotiated return of the material.

Speed matters twice over. Evidence decays as devices are reissued and logs rotate, and remedies like injunctive relief reward parties who moved promptly once suspicion arose.

Instructions we commonly take

• Departing employees suspected of taking client lists, pricing or designs.
• Breach of restrictive covenants evidenced through devices and accounts.
• Policy-breach investigations requiring findings that withstand challenge.
• Pre-emptive imaging of leavers' devices before reissue.

Frequently asked

An employee just resigned and we suspect data theft. What should we do today?

Preserve, quietly: retrieve and isolate the laptop without examining it, suspend nothing in the cloud account yet, and take advice before confronting anyone. Internal inspection before imaging is the most common way this evidence gets damaged.

Can you examine the employee's personal devices or accounts?

Only with a lawful basis: consent, a court order, or clear authority. We advise on the boundary honestly; overreach can poison otherwise strong evidence and create liability of its own.