e-forensics inc

Handling Former Employee's Computer:

Theft of IP matters against former employees, and wrongful termination lawsuits have something in common: the former employee's computer will likely have valuable evidence. Unfortunately most of the time the computers will be re-imaged (software reloaded) and put back into production for the new hire.

HR policies regarding exiting employees should consider the potential loss of emails/documents/log files stored on workstations. The obvious mitigating procedure would be to create a sector-by-sector image of the computer's hard disk to maintain until the company is reasonably certain the departed employee will not present a litigation risk.