Listen to your gut when an employee who had access to confidential information leaves your company. Were they vague on their next steps? Is there a chance they’re going to work for a competitive venture? Are you concerned about the kind of information they had access to? If so, there are steps you can probably take (in house!) that will either soothe or further upset your gut. You want to know as soon as possible if you have a case of misappropriation of your company’s confidential information on your hands.

Here are the forensic steps that your in-house IT guru may be able to help you take:

  1. Review e-mails forwarded to a personal or non-company e-mail address. Don’t forget to check the deleted items folder.
  2. Check the internet browser history and the downloads folder. Is there a lot of activity on On the website of a competitor? Did the employee download a document (e.g., job application) that gives you a hint as to their intended future business activities?
  3. Check recently printed files. We live in a digital world, it’s true, but we all know how to kill trees. I’d like to provide more details on how to do this, but it’s specific to your tech setup, so instead I advise that you google: “How do I view previously printed documents?”

As with any self-help methodology, you need to know enough to know when you should consult an expert. Speed can be key, and experts are faster. Preservation of evidence is also always at the top of my list of considerations. In addition, a laptop contains many more types of forensic information than those listed here. If you aren’t familiar with those, best to combine self-help with a consult to your friendly trade secrets lawyer.

Finally, these steps work best when undertaken as soon as possible after the employee’s departure. I just read about a trade secrets case filed by an energy company this month against a former executive who allegedly took trade secrets when he left the company three months ago. While there may be a good explanation for the delay, ideally, the forensic search that uncovered this alleged misappropriation should have occurred back in February.