You have been warned. Especially if you are reading this at work, or working on your blog at work.....Or if you surfing the web at work, etc. Remember to use an anonymizer and clean those files.
Electronic Evidence: Catch The Rogue Employee
By Adrian Miedema
The explosion of e-mail communication presents risks and opportunities for employers. Electronic files can be a goldmine of evidence against rogue employees – particularly when the employee believes the file to have been permanently deleted.
Deleted Files: The New "Smoking Gun" Evidence?
Just as e-mails and electronic files present risks, they present great opportunities for lawyers and human resources professionals. It is commonly understood that a "deleted" e-mail or file is gone forever. This is not true. By "deleting" a file, one deletes only the file name and path to the file; the contents of the file actually remain. Often it is only when the hard drive or disc fills up, and the computer needs the disc space, that the "deleted file" will be overwritten. Because most people use far less than 100% of their hard drive space, many deleted files are never overwritten.
The "deleted" files may be recovered with the assistance of a forensic information technology professional who can obtain an "image" of the hard drive, which is an exact copy of the drive, including deleted files. The professional can then find and restore deleted documents including e-mails. It is almost always advisable to use an external forensic IT professional because the person who obtains the "image" may be called as a witness in court. Without formal training in forensics, an inhouse technology professional may see his or her evidence destroyed in cross-examination – and may also be accused of bias.
Because most employees believe that "deleted" really means "deleted", they are often very free with what they say in e-mails – some of which are sent and then promptly deleted. As a result, in employment litigation matters, deleted e-mails can often become critical evidence, if not a source of amusement.
Unbeknownst to most people, personal e-mails sent from work using an employee’s web-based e-mail account such as "Hotmail" will often reside on the work computer. An employee, believing that these e-mails could not be seen by the employer, will often be free with what she says in – or what documents she sends along with – such e-mails. Privacy implications and systems use policies should be considered and consulted before using any such "personal" e-mails as evidence.
Recovered e-mails are particularly useful evidence where an employee steals intellectual property or takes steps – while still employed – to compete against the employer. For instance, an employee might send a customer list by e-mail to his personal e-mail address and then delete the e-mail. That e-mail will usually remain on the hard drive and will be "smoking gun" evidence in legal proceedings against the former employee, such as injunction proceedings to prevent the employee from competing or soliciting clients.
But employers must think beyond computers. Other devices such as cell phones, Blackberries and Palm Pilot-type devices all have memory that can be "imaged" and preserved by the forensic IT professional. The employer should take steps to preserve the potential goldmine of electronic evidence on a departed employee’s hard drive. Don’t shut the computer down, but do ensure that it is safeguarded. In particular, where key salespersons or other key employees depart, the employer should consider obtaining a forensic image of the employee’s hard drive. If litigation arises, the employer may then analyze the forensic image and determine whether, for instance, the employee stole customer lists. The forensic image of the hard drive may be stored and used later if necessary.
Similarly, before dismissing a key employee, the employer should secure the employee’s laptop, cell phone, Blackberry or Palm Pilot to ensure that the employee cannot, after the dismissal, permanently delete or "scrub" files from those devices.
Knowledge is Advantage
Since many employees are not familiar with the recovery of "deleted" files, employers who understand these concepts have a real advantage, particularly where emloyees have engaged in nefarious activities. Employers should take steps to preserve "deleted" e-mails and files that may become key evidence in litigation.
Find blog posts, photos, events and more off-site about:
work, email, computers, laptops, palm, blackberry, laptop, computer-security, firings, blog, blogging, , electronic-files,
