A subsequent analysis showed that, on the eve of the former
executive's departure, he had searched for "data destruction" on the
internet. Afterward, he purchased and downloaded software specifically
designed to securely erase electronically stored information (ESI) from a
computer by overwriting it — rendering it unrecoverable.
The analysis also revealed use of an external hard drive, and an
attempt to delete files after a copy was made of them. The company asked
our forensic expert to perform additional analysis on the laptop and
attempt to recover any of the deleted and overwritten ESI. By looking at
hidden content stored as part of the laptop’s operating system backup
files, our experts located and recovered hidden versions of all of the
ESI. They were also able to trace the former employee's almost every move, catching him in the act of misappropriating information.