When the suspicion is inside the company, the evidence must be preserved before anyone notices, and in a way that holds up in court later. The examination separates "I was hacked" from "it was me", with the same impartiality in both directions.
A complaint comes in, and the company asks IT to examine the employee's computer. The intention is good; the result, almost always, is contaminated evidence. Switching the machine on, opening folders and browsing the history creates and erases traces. Afterwards, nobody can separate what the person under investigation did from what the internal inquiry did. One of the real cases on this page shows how far that can go.
Proper preservation follows a different order. The original media is copied with write blocking, which prevents anything from being written to it. Analysis happens only on the copy, with hash and chain of custody. When the case calls for it, the collection is witnessed by a notary for a notarial deed (ata notarial), and the expert's role is to say what needs to be put on record so that the procedure cannot be challenged later.
Those who engage this unit are usually compliance, the legal department or the board. The examination does not replace their investigation: it gives it technical evidence.
In forensic practice, those who defraud the company from inside usually fit one of three profiles. Understanding which one applies guides where to look for the traces.
Notices a flaw in the process or the system and starts exploiting it on his own, like the employee who, for months, uses support access to change limits and issue cards. The trace lies in the repeated use of a legitimate function, outside the normal pattern.
Agrees to take part in a fraud run by outside criminals, in exchange for a percentage or a sum. Hands over how the systems work, the best moment to act and how to get around the controls, sometimes the second authentication factor itself. Afterwards, tends to present himself as a victim.
Acts out of fear, after threats against his own safety or his family's. The examination shows what was done, by whom and in what circumstances, and that context weighs in the company's decision.
There are also those who copy confidential data to hand to a competitor or to keep for themselves. And the examination always tests the opposite hypothesis. In one case, the "hacked machine" theory collapsed in the face of the browser history, the development tools and the version control of the person under investigation himself. In another, the institution suspected an insider, and the examination showed the accesses came from credentials stolen by phishing. The method also looks for the forged trace: a trail planted to hide the perpetrator, whether external or internal.
When the suspicion reaches many devices, examining each one in depth is slow and, almost always, unnecessary. Batch triage begins with broad preservation of all the devices of interest, with hash and chain of custody. It is the stage that most demands the expert in the field.
With the copies in the laboratory, the analysis sweeps the whole set for traces of the fact under investigation. Devices without traces are closed out administratively. The positive ones go on to in-depth examination, to the standard of a court expert report. In one case of offensive messages, dozens of computers went through triage, and only the positive ones went further.
The gain is avoiding fruitless examinations, which do not help the client recover losses, understand the incident or establish authorship.
The interview comes after the evidence is preserved, never before. It is conducted by partner forensic psychologists and by professionals with long experience in behavioural and micro-expression analysis, and the script starts from what the examination has already shown.
Open-source research on those involved in the inquiry maps the relationships between people and companies, with the origin of each piece of information recorded and chain of custody.
This is not compliance for certification. The question is a different one: if an incident happens tomorrow, will the company be able to investigate it? Do the logs exist, are they kept for as long as needed and do they identify who did what? Where does maturity need to improve, and in what?
The difference shows when it is missing. In one fraud case, the company did not keep the source ports of connections, and the inquiry stopped at hundreds of suspects, with no way to point to the perpetrator. In another, the opinion concluded that authorship could not be established for lack of logs and delivered a plan for the environment to start generating the necessary traces.
The audit also examines workstations and servers. It has found, for example, card numbers stored in plain text on the workstations of one department, with formal notification to the company. Incidental findings, outside the object of the audit, follow the legal obligation.
In anti-corruption investigations, this carries legal weight. When applying sanctions, the Anti-Corruption Act takes into account the company's cooperation in the inquiry and the existence of internal integrity and audit mechanisms (Law 12,846/2013, the Brazilian Anti-Corruption Act, art. 7º, VII and VIII). An internal investigation with intact evidence is part of that response.
Challenge. An employee was accessing confidential data on a recurring basis, using a personal device. The device was his, and the company could not examine it.
Method. Analysis of the network traffic demonstrated the recurring exfiltration and grounded the application for an injunction for search and seizure of the device, which was granted.
Outcome. In the court-ordered examination, it was proved that the confidential data were on the device and had been handed to a competitor.
Challenge. Compliance received a complaint that a director was accessing, at work, inappropriate content contrary to the company's ethics policy. He was suspended, and the computer went to the technology department. For days, several IT staff examined the original machine, until one of them found the accesses. The director was dismissed for cause.
Method. In the labour lawsuit, the examination reconstructed the timeline of the equipment and showed that the accesses were made after the computer was handed to IT, during the internal inquiry itself.
Outcome. The dismissal for cause was reversed, and the case led to a claim for damages to the executive's reputation. It is the picture of the mistake described at the top of this page: IT examines the original and contaminates the evidence.
Challenge. At a manufacturer whose sales were restricted to approved customers, some of them began receiving invoices for products they had never ordered or received. Employees were booking sales in the name of approved customers, diverting the delivery and reselling the products outside the authorised channel; they then paid the invoices so that the fraud went unnoticed.
Method. The examination followed the digital and documentary trail of the orders, the deliveries and the payments to whoever had booked them.
Outcome. Those involved were identified and dismissed, and the case led to criminal proceedings.
See also
Labour and Employment Litigation → LGPD, ANPD and Data Breach Forensics → Intellectual Property, Trade Secrets and Unfair Competition → Financial Fraud and Payment Systems Forensics → Anti-Forensics and Destroyed Evidence → Digital Counter-Espionage → Information Security and Compliance → Method and Chain of Custody →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case