Draft Report Overstates Cloud Exfiltration
You are the forensic examiner for a company investigating an employee who copied source code to a personal Google Drive. The laptop is company-owned; the employee signed an acceptable-use policy and a monitoring notice. You imaged the laptop and found a browser history entry to drive.google.com, a synced folder path, and a 2.1 GB zip file in the Recycle Bin. The zip file was deleted; $I/$R metadata shows deletion 11 days before the investigation. The cloud provider has not provided logs. HR wants a report stating the employee stole the code. Outside counsel asks whether the report can say the file was uploaded. The draft report says the evidence conclusively proves exfiltration. The employee has retained counsel and requests the image and notes. The case is in a US jurisdiction with no applicable privilege.
1. How should you revise the conclusion about exfiltration?
Read the worked answer
Replace conclusively proves exfiltration with language that separates observation from inference. The evidence supports that a 2.1 GB zip file existed, was deleted, and that browser history and a synced folder path reference Google Drive. It does not establish that the zip file was uploaded, that the uploaded content was the source code, or who performed the upload, because no cloud-side logs are available. State that the findings are consistent with attempted or actual cloud storage use but that exfiltration is not established. Explain the missing link: a completed upload requires provider or network evidence, or endpoint logs showing successful transfer. This revision keeps the report accurate and avoids an unsupported ultimate conclusion.
2. What legal and ethical obligations affect how you respond to the employee's counsel and HR?
Read the worked answer
The company-owned laptop and signed acceptable-use and monitoring notices provide a stated basis for the examination, but the report must still be accurate, preserve evidence, and disclose limitations. Counsel's request for the image and notes should be handled through the company's legal process, with a documented chain of custody and appropriate confidentiality or protective order. Do not delete drafts, notes, or the image after litigation is reasonably anticipated. Distinguish factual findings from opinions and include information that may undermine the preferred conclusion. HR's desired wording cannot override the examiner's duty to avoid misleading statements. The reasoning is that credibility and defensibility depend on preserving both evidence and intellectual honesty.
3. What additional evidence would you request before allowing a statement that the source code was uploaded?
Read the worked answer
Request Google Workspace or Drive administrative logs and account activity through legal process, including upload events, timestamps, file names, sizes, and IP addresses. Seek network proxy, firewall, and DNS logs for drive.google.com and related domains around the deletion window. Examine endpoint sync-client logs, browser cache, download or upload history, and any memory or pagefile artifacts. Hash the zip file and compare it with known source-code repositories or DLP records. Review email, chat, and badge or VPN logs for corroboration. Only when these sources tie the zip file or source code to a completed upload should the report use that conclusion; otherwise, keep the finding qualified and identify the missing evidence.