The case study involves an emerging business providing specialist technical services to a range of mining exploration companies. The business had lost a number of its technical experts to a rival business and noticed a drop in in its market share. There was a suspicion that departing staff members may have stolen some proprietary knowledge and expertise, which they later shared with the competing business. A forensic examination of the business' server and the computer terminals used by the departed staff members was initiated to determine whether some form of industrial espionage or sabotage had occurred.
With little to go on other than the CEO's hunch that there was mischief afoot, the former employees' computer terminals and external storage devices were searched for evidence of possible misconduct. Logically, the employees' e-mails were considered to be a sound starting point, but examination only recovered...