Hour Zero: Freeze, Don’t Investigate
The instinct is to have IT "check the laptop". Resist it. Every login, file opened and setting browsed overwrites the very timestamps and artefacts that prove exfiltration. Take the device out of circulation, do not reissue or reimage it, and record who has handled it and when. The same applies to their phone, if company-issued.
Preserve the Accounts Before They Expire
Suspend deletion policies for the employee’s mailbox, OneDrive/Google Drive, Teams/Slack and any CRM access. Cloud audit logs are gold — they record downloads, sharing, and sign-ins by device and location — but many are retained for as little as 30–90 days on default settings. Export or extend retention now, not after counsel is briefed.
The Artefacts That Prove It
A forensic examination of the returned laptop typically establishes: USB devices connected and when, files copied to them, uploads to personal cloud accounts, personal email use, mass deletions and wiping attempts, and the use of AirDrop or file-transfer tools. Correlated with cloud logs, this builds a timeline that is very difficult to explain away.
Don’t Tip Them Off
If the employee is still serving notice, covert preservation may be appropriate — imaging devices and capturing cloud state without alerting them — done lawfully under your policies and legal advice. Alerting a suspect before preservation reliably triggers deletion.
The Checklist
1. Quarantine the laptop and phone — no IT inspection. 2. Suspend account deletion and extend log retention. 3. Export cloud audit logs. 4. List what data is at risk and where it lived. 5. Note key dates: resignation, last day, new employer. 6. Brief your lawyer. 7. Engage a forensic examiner for preservation — imaging first, questions later. Foren6ix can usually preserve devices within 24–48 hours anywhere in Australia.