Stop using the device, do not let IT reimage or reissue it, and have a forensic image taken before anything else happens. The most common way evidence is destroyed in departing-employee matters is routine IT hygiene — wiping and redeploying the laptop — carried out in good faith days before anyone suspects there is a dispute.
The first hour
Take the device out of service and leave it alone. Powered off and stored, or powered on and untouched — but not in use. Every hour a machine runs, background processes write to disk and may overwrite deleted content that has not yet been recovered.
Tell IT in writing to hold it. Standard offboarding wipes and reissues laptops, often within days. That process is designed to be irreversible. A short, explicit instruction naming the asset tag is worth more than a general legal hold notice that IT reads as applying to email.
Do not look through it yourself. Browsing the file system changes access timestamps, and those timestamps are frequently the evidence — they are how an examiner shows which files were opened in the final week. A manager who "just had a quick look" has damaged the artifact they were trying to preserve, and has made themselves a witness.
Preserve the accounts too. The laptop is one endpoint. Email, cloud storage, the VPN and remote-access logs, badge records, and any messaging platform typically carry as much signal, and several of those have short default retention windows that keep running while everyone focuses on the hardware.
Why imaging beats a backup
A backup captures the files the system agrees to show. A forensic image captures the whole device — including deleted files, slack space, and the artifacts that record activity rather than content.
In a departing-employee matter the activity artifacts usually matter more than the documents. Records of USB devices attached, of files opened, of cloud-sync clients installed shortly before resignation, and of large transfers to personal accounts are what establish what happened. A backup preserves almost none of it.
Solid-state drives make this urgent
On an SSD, the drive's own firmware may erase deleted data with no user or operating system involvement — garbage collection runs on the device's schedule, not yours. On a traditional hard disk, deleted content commonly survives for weeks. On an SSD it can be gone in hours, and it is gone permanently.
This is the strongest argument against "we'll deal with it after the holiday weekend."
Personal devices, and the line to be careful about
If work was done on a personal phone or home computer, the evidence may sit on hardware the company does not own. Imaging an employee's personal device without clear authority creates privacy and, depending on jurisdiction, statutory exposure that can be worse than the underlying dispute.
The usual routes are consent, a preservation agreement negotiated through counsel, a court order, or a neutral examiner protocol where an independent expert images the device and produces only responsive material to the parties. Which is appropriate is a legal question, not a technical one — but do not let uncertainty about it delay preserving the devices you unambiguously do own.
What to hand the examiner
A short factual timeline helps more than anything else: resignation date, last day of access, where the person went, what they had access to, and what specifically is feared to have left. It converts an open-ended examination into a bounded one, which is both faster and more likely to produce a clear opinion.
From our work
Need this looked at properly?
Our examiners and testifying experts work these questions for a living. Tell us what you're facing.
Reviewed by Law & Forensics. See our editorial standards.