This recent case study exemplifies some of the problems that occur during examinations and provides some tips on avoiding certain pitfalls that occur.
This was an industrial espionage case involving a member of staff who was suspected of stealing the intellectual property of the employer. Suspicion arose when the CCTV footage of the office detected the employee's presence at his workstation during out-of-office hours for a 2-hour period—unusual activity for staff members. Scrutiny of the CCTV footage showed a partial view of what appeared to be the employee's laptop, on which could be observed the opening of files on the desktop.
Examination of the company's server confirmed the download of a number of files, including images, spreadsheets, and some text documents, at the same time as the CCTV footage. The server logs also showed synchronization between the server and the e-mail account on the laptop...