Computer ForensicsMobile Device ExtractionWhatsApp and Chat ExaminationDigital Authorship and Subscriber DataCloud, Identity and DevOpsAnti-Forensics and Destroyed EvidenceDigital Counter-Espionage
Forensic Data Recovery
Handwriting and DocumentsDigital Document ExaminationElectronic SignaturesSignature by ProxyInitials and ParaphsSelf-ForgeryDocuments and TypescriptFingerprint Examination
Forensic PhoneticsAudiovisual ForensicsJudicial and Extrajudicial Work
Security and ComplianceCorporate InvestigationsFinancial Fraud and PaymentsLGPD, ANPD and Data BreachesSoftware ForensicsIntellectual Property
IT Arbitration and MediationSee all units →
LawyersPractice AreasCompaniesIndividualsInternational PracticePress
Expert ReportsMethod and Chain of CustodyForensic LaboratoryFrequently Asked Questions
About Adriano VallimRepresentative CasesCredentialsIn the MediaPublicationsTraining and SpeakingCourses for Lawyers
Blog Request an Examination
PortuguêsEnglishEspañol
Home // PRACTICE AREAS // LABOUR AND EMPLOYMENT

Forensic Services in Labour and Employment Litigation

Dismissal for cause over fraud or a data leak is decided on technical evidence. Collected the right way, it upholds the company's decision; collected by the IT department, it usually upholds the reversal.

The lawyer's question

Cause is proved, not presumed

Acts of dishonesty, misconduct, habitual dealings that compete with the employer and breach of company secrets are among the offences that the CLT, the Brazilian labour code, accepts as grounds for dismissal for cause (CLT, art. 482, items a, b, c and g). In the labour claim, proving the offence falls to the company: it is the fact the company opposes to the employee's right (CLT, art. 818, II).

When the offence took place on the computer, in e-mail, in the system or on the corporate phone, that proof is technical. The examination establishes the employee's actions and omissions in the technology environments, documents each one and gives the company a basis to decide before the dismissal. That is what avoids the reversal.

Adriano Vallim is a court-appointed expert registered with the TRTs (Regional Labour Courts) of the 2nd and 3rd Regions and also acts as party-appointed expert.

Typical situations

Where forensics comes in

Insider

Internal fraud

The employee who spots a flaw and defrauds the company, the one recruited by criminals in exchange for money, the one acting under threat. The examination shows what each one did, when and with which access. The three profiles are detailed in Corporate Investigations and Compliance.

Leak

Data taken before leaving

Copying of customer databases, projects or confidential documents, to hand to a competitor or to keep. The examination locates the copy, the means used and the destination.

Recruitment

Insider in fraud against a financial institution

The employee who tells the criminal group how the system works, the right moment to act and how to get around the controls, or who hands over their own second authentication factor. Afterwards, they usually claim to be a victim.

Anti-forensics

Erased traces

Disk wiped on the day the laptop is returned, history cleared, files deleted. The examination demonstrates the destruction and recovers what can be recovered.

Messages

Conversations and audio

Screenshots, WhatsApp conversations and audio filed in the Labour Courts to prove conduct or to contest it. The examination verifies integrity and authenticity before the evidence is challenged.

Preservation

The mistake that most often reverses dismissal for cause

The report comes in, and the IT department examines the employee's computer. Every click alters traces, and what would prove the offence no longer serves as evidence. The first case below shows the result.

The right preservation: write-blocking of the original media, analysis only on the copy, hash and chain of custody. Where appropriate, the collection is witnessed by a notary for a notarial deed (ata notarial), with the expert indicating what needs to be recorded. Preservation can be done confidentially, before the employee is removed, without alerting the person under investigation.

Case work

Situations like yours have been through this laboratory

REAL CASE · ANONYMISED

The dismissal for cause that IT undid

Challenge. A director was removed after a report of access to improper content, contrary to the company's ethics policy. For days, several IT staff examined the original computer until they found the accesses, and he was dismissed for cause.

Method. In the labour claim, the examination showed that the accesses were made after the computer was handed to IT.

Outcome. The dismissal for cause was reversed, and the case turned into a claim for damages to the executive's reputation.

REAL CASE · ANONYMISED

Sales booked in the name of customers who never bought

Challenge. Customers of a manufacturer received invoices for products they never ordered. Employees booked sales in their names, diverted the delivery, resold the products outside the authorised channel and paid the invoices to hide the fraud.

Method. Order by order, the examination cross-checked the entry in the system, the delivery and the payment of the invoice, and reached the users who had recorded the sales.

Outcome. The findings supported the dismissal of those involved, and the case went on to criminal proceedings. The full version is in Corporate Investigations and Compliance.

Frequently asked questions
Can it be proved that he copied the files before leaving?
Often, yes, if the equipment is preserved before being reassigned. Connection of USB devices, synchronisation with a personal cloud, sending by e-mail and access to files leave records in the system and on the corporate platforms. Formatting the laptop or handing it to another employee erases most of them.
IT has already examined the computer. Is there still anything to be done?
There is, within limits. Through the equipment's timeline, the examination separates what the employee did from what was done during the internal examination. What the handling overwrote may not come back, and the expert report says so. The sooner the machine stops being used, the better.
Should the examination be done before or after the dismissal?
Before, whenever possible. With the expert report, the company decides knowing what it can prove. After the dismissal, the equipment is usually reassigned, and the evidence is lost.
Who engages the examination?
The company, through its legal or compliance department, or the labour lawyer handling the case. In the proceedings, the work is as court-appointed expert or as party-appointed expert for one of the parties.

See also

Corporate Investigations and Compliance →   Anti-Forensics and Destroyed Evidence →   WhatsApp and Chat Examination →   Forensic Extraction from Mobile Phones and Devices →   Forensic Phonetics and Voice Examination →   Intellectual Property, Trade Secrets and Unfair Competition →   Judicial and Extrajudicial Expert Work →

Before the pleading, the technical reading of the case

Confidential initial consultation: what the available evidence supports, what still needs to be preserved and which examination the case calls for.

Confidential consultation

The technical evidence your case requires. The authority courts respect.

Initial feasibility consultation at no cost. Reply within 24h on business days.
Request an Examination