Protecting the Corporate Jewels

There are a number of things to consider when using digital forensics for investigating potential theft or improper usage of proprietary data. Bring Your Own Device protocols add complexity to a situation in which corporations already use traditional data sources such as a desktop, laptop, server and corporate email.

There are certain electronic data sources that defendants, plaintiffs and forensic neutrals alike should consider for any investigation. These include laptops/desktops (workstations), email servers, file servers, external media, online repositories, personal email accounts, home computers, smartphones and other mobile computing devices. It is important to understand the types of servers in use and the general terms data custodians and users may utilize when describing them.

One way to exfiltrate large amounts of data is through the connection of an external device. It is very easy to mass copy files, disconnect the device, and leave with it. One way to view a user’s activity is through the review of link files, a shortcut on a local drive that may indicate the history of a file being opened from an attached device. With respect to employee-owned devices, in addition to implementing and reinforcing a culture of security and reserving the ability to “wipe” devices if they are lost or stolen, companies should also consider ongoing security training and annual employee acknowledgment, and otherwise set and manage employee expectations about the privacy they will have to surrender in exchange for the convenience of using their personal devices for work.