Problem
The head of the HR department and General Counsel called you into a confidential meeting with no notice. They have a report of an insider risk, where a co-worker was stealing financial documents prior to the company's IPO.
A report from an anonymous co-worker said the actor appeared to have uploaded company financial files to DropBox or via email within the last 48 hours. Your company does not use DropBox and it is not installed on the workstations.
The accused co-worker is claiming innocence, has been placed on administrative leave, and is threatening to sue the company.
The Head of HR and the GC have asked you to:
i. Outline everything you need to perform a forensic examination to determine if the accusation is true.
ii. Identify the data that will appear as a result of your examination.
iii. Identify what you need to appear at a deposition (and possibly go to court) as an expert witness.
Prepare an outlined response for the Head of HR and the GC's requests.