What We Investigate
- →Departing employees. Whether company data was copied to USB drives, personal email or cloud storage before someone left. Read more.
- →Misconduct and HR investigations. Examination of work devices, email and messaging to establish what happened and when.
- →Business email compromise. Review of Microsoft 365 and Google Workspace audit logs to trace account access and changed payment details. See email & cloud forensics.
- →Internal fraud. Tracing documents, communications and deleted records connected to suspected fraud.
- →Litigation readiness. Forensic preservation so the evidence can be relied on if the matter goes to court.
Discretion
We can collect devices and data out of hours and on site, so an investigation does not alert the people involved. Findings are reported to in-house counsel, HR or your external lawyers as you direct.
Act Quickly
Evidence on work devices is overwritten through normal use. If you suspect data theft or misconduct, take the device out of use, do not let IT reset or reissue it, and preserve the user's mailbox and cloud accounts. We can advise on preservation the same day you call.
Related Guides
Common Questions
An employee has resigned. Can you tell what they took?+
We examine the work laptop, phone, email and cloud accounts for signs of copying, uploads, USB use and forwarding to personal accounts, and report what was accessed and when.
Can you do the work without the employee knowing?+
Yes. Company-owned devices and accounts can be imaged out of hours and on site, so the investigation does not alert anyone.
Who receives the findings?+
You decide. We report to in-house counsel, HR or your external lawyers, and can prepare an expert report if the matter goes to court.
Background
Every matter is handled personally by Bobby Pabla, an IACIS-certified examiner (CFCE, ICMDE) with 16 years in law enforcement and government investigation, including the New Zealand Police, the NZ Serious Fraud Office and PNG's Independent Commission Against Corruption. He has given expert evidence in criminal, civil, family and insolvency matters.
Supporting an HR or workplace investigation? See workplace and internal investigations.