The three insider profiles, what must exist before suspicion arises, the departure that preserves the evidence and the dismissal for cause that holds up.
When fraud or a leak comes from inside, the evidence is on the computer, in the email, in the systems and on the company phone of the person under suspicion. And it has a date to disappear: the day they leave. The laptop comes back formatted, the account is deleted, the phone goes to someone else.
The other mistake is the internal inquiry. IT switches the machine on to "take a look" and creates traces on top of those that would prove the misconduct. In the employment claim, the forensic examination shows access after the handover to IT, and the dismissal for cause falls.
The course starts from the three insider profiles seen in forensic practice, the opportunist, the co-opted and the threatened, and covers the whole path: hiring, suspicion, departure and expert report. It is the subject of Adriano Vallim's talk at Fenalaw 2026, "Nem Todo Ataque Vem de Fora" (Not Every Attack Comes from Outside), in a classroom version.
Pick as many courses as you like: they are kept and arrive ticked on the registration form.
An employee was under suspicion, and the equipment was preserved covertly before the employee was removed. On return, a second preservation found the disk zeroed by a command sent to the drive's controller. The examination demonstrated deliberate deletion on the day of return, and the first copy secured the content that someone tried to destroy.
A director was suspended after a report of access to improper content. For days, IT staff examined the original computer until they found the access, and dismissal for cause followed. In the employment lawsuit, the examination showed that the access occurred after the machine was handed to IT. The dismissal for cause was reversed.
In a fraud against a fintech, the employee whose account was used presented himself as a victim. The attacker moved through the systems without errors or trial attempts. The examination showed that the employee himself had given the external actor the access needed for MFA authentication.
In groups, participants receive the scenario of a manager suspected of copying the customer database before resigning, with the list of his equipment and accounts. In 15 minutes, they build the departure plan: what to preserve, in what order, who does each step and what must not happen to the laptop, the phone and the accounts. The correction uses the checklist provided.
Laws and rulings discussed
CLT, art. 482, items a, b, c and g (Brazilian Labour Code) · CLT, art. 818, II · Law 9,279/1996, art. 195, XI (Brazilian Industrial Property Act) · TST (Brazilian Superior Labour Court), AIRR 613/2000-013-10-00.7
See also
Corporate Investigations and Compliance → Forensic Services in Labour and Employment Litigation → Anti-Forensics and Destroyed Evidence → Intellectual Property, Trade Secrets and Unfair Competition → See all courses →