Insider Exfiltration, Works Council Rules and a Sealed Laptop
A finance analyst copied roughly 4 GB to a removable USB device two days before resigning. The DLP alert records the device serial, volume label and file count but not file names. Badge logs show late-night access; proxy logs show no uploads. The laptop is company-owned, BitLocker-encrypted with the key escrowed, and currently powered off in the analyst's locked desk drawer. A works council agreement states that device searches require employee consent except in cases of serious misconduct, and that in all cases HR and legal must approve in writing before examination. The analyst is on approved leave for five days and is not answering calls. HR wants the laptop today, IT wants it reimaged for the replacement starter on Monday, and the investigator has a portable imager ready.
1. Can you image the laptop today? What authorisation is required, and what do you do while waiting?
Read the worked answer
Not today, on the current facts. Company ownership of the hardware does not by itself override the works council agreement; that agreement is the governing instrument for how the employer may examine employee devices, and it sets a written HR and legal approval step. The DLP alert is a suspicion, and whether it meets the 'serious misconduct' threshold is a determination for HR and legal, not for the investigator. Proceeding without that determination risks the evidence being excluded or triggering a labour dispute that outlasts the case.
Immediate actions: take custody of the device, place it in a sealed evidence bag with a signed and dated custody label, and store it in a controlled locker. Do not power it on, do not connect it, and do not let IT reimage it. Issue a written preservation notice to IT covering the laptop, the DLP console, badge system, proxy and file server logs, and any endpoint agent telemetry, with instructions to suspend rotation. Draft the authorisation request to HR and legal setting out exactly what you intend to acquire, why it is proportionate, and the alternatives.
Ask HR whether a consent request can be put to the analyst in writing despite leave. If approval is refused, the case may still proceed on DLP, badge and server-side logs, but the endpoint evidence is lost and that limitation should be recorded.
2. Authorisation is delayed five days. What do you preserve now, and how do you keep the chain of custody intact?
Read the worked answer
Preserve everything that decays while the laptop sits sealed. Endpoint agent telemetry has the shortest retention and may hold the USB serial, process name and file paths; request an immediate export. DLP console records, proxy logs, VPN and badge logs, file server access logs, email and collaboration audit logs all need preservation letters with a rotation freeze. Where the SIEM normalises timestamps, capture both raw and normalised values. Hash every export at the time it is made, record the exporting system and operator, and store on write-once media.
For the laptop: photograph the sealed bag and the label, record the serial number and the condition of the device, and keep a custody log with every movement signed. Do not open the bag to check anything; a reseal creates an unnecessary challenge. Confirm the BitLocker recovery key is retrievable from escrow without anyone logging into the device, and record who accessed the escrow and when, since that access will be examined.
Plan the acquisition to be proportionate: if the approval is limited to the finance data, consider a targeted logical collection alongside the full image, and document why the scope chosen matches the authorisation. Prepare the imaging environment in advance so that acquisition can start within minutes of written approval arriving.