Re-imaged on Saturday Morning

What is gone: the endpoint as an evidential source. Re-imaging destroys the original volume, and there is no hash-verified image of the drive as it stood on Friday. The re-imaged laptop has negligible value. No forensic copy, no chain of custody, no write-blocker - this is the bank's central problem.

What survives - and it is not nothing:

• Microsoft 365 mailbox and OneDrive/SharePoint activity, held by Microsoft, including the contents of the mailbox and file access events.
• Unified audit log and mailbox audit log - retention 30 days, and we are at day 12. This is the critical fact: the window closes in 18 days, and the deleted account's logs may expire sooner on deletion.
• The soft-deleted account - recoverable in Microsoft 365 for 30 days after deletion; it is day 10 since deletion.
• Endpoint management / device control logs (USB serial number, connect and write events), antivirus/DLP logs, print server, file server access logs, VPN and badge records.

Today, in this order (order of volatility):

1. Written litigation hold / preservation notice to IT and HR; suspend all deletion, re-imaging and account clean-up.
2. Restore the deleted mailbox and place it on hold; export the mailbox and the full audit logs to a forensically sound container, hash it, and record who did it and when.
3. Export device control, DLP, file-server and badge logs.
4. Identify and interview the IT technician who re-imaged - get a written statement now, and secure the re-imaging job ticket.
5. Interview the manager who saw the copy; secure any screenshot.

Every day of delay shrinks the case.

Probably provable: that a USB mass storage device was connected to her corporate laptop on that Friday and that files were written to it - if device control or DLP logging was enabled and records the device serial number, the file paths and timestamps. That, plus the manager's eyewitness account and the folder name matching a known share, is a strong circumstantial case of unauthorised copying.

Probably not provable from the bank's own systems: the volume and content copied, and what happened to the data afterwards. Without the endpoint image you cannot show which files were selected, whether the copy completed, or whether the device was personal. Resist any temptation to describe the whole 'loanbook' folder as exfiltrated - the manager saw a progress dialogue, not a completed transfer.

Where to look for the missing link:

• File server access logs - which files in that folder were opened or read by her account in the preceding days (staging behaviour).
• Mailbox - emails to a personal address, or to a competitor, with attachments or links.
• Cloud storage sign-ins from the corporate network or her device.
• The USB itself, if it can be lawfully obtained (with her consent, or under a court process). Its serial number will match the device log if it is the same one.

Frame the finding precisely: 'the evidence establishes that a USB device was connected and data written at 16:42 on Friday; the volume cannot be determined.' That sentence survives cross-examination. 'She stole the loan book' does not.

Evidential risks:

• Electronic records are admissible but must be authenticated. Expect to produce a certificate or witness evidence on how the logs were generated, stored and extracted, by whom, and whether the system clock and access controls were reliable. The IT administrator who exports the logs will be a witness; prepare him.
• The re-imaged laptop invites an adverse inference argument. She will say the bank destroyed the evidence that would have shown the copy failed or that the device was hers. The bank must explain the destruction honestly - a routine re-imaging driven by a leavers' checklist and a Monday starter - and show it was negligent, not deliberate.
• Proportionality and data protection. Customer loan data engages the Data Protection Act. Accessing her mailbox must be under a policy that permits it, or with consent; otherwise the bank creates a parallel liability and gives her a counterclaim.

Procedural risks: the disciplinary process must be fair - notice, allegations in writing, a hearing, right to be accompanied - and must not depend on the forensic report alone. The forensic report should be issued as evidence, and its author available for cross-examination.

What the report must say about the laptop: a clearly labelled limitations section stating that the endpoint was re-imaged before forensic preservation, that no image or hash exists, that the endpoint is therefore not relied upon, and that the findings rest on server-side and cloud logs. Also recommend, in the management section: a written first-responder procedure (isolate, do not re-image, image and hash, log custody), preservation hold as the first action in any suspected data theft, and extension of audit log retention well beyond 30 days.