The Laptop in the Laundry Basket
Dana hires an agency in a divorce and custody matter. She brings in a laptop and a USB drive she says she found in the laundry basket, belonging to her husband, a project engineer at a defense contractor. They share the house, but the laptop is employer-issued and carries an asset sticker. Dana wants 'everything': email, texts, location history, and 'the work files.' The forensic technician images the drive, opens a cached personal email account, and finds a text thread about hiding a brokerage account, a folder of the employer's proprietary engineering drawings, and a personal photo folder. Dana then says, 'Wipe it and put it back before he gets home so he never knows, and delete the work stuff. That is not ours.'
1. Is Dana's consent sufficient authority to access the laptop and its contents? Analyze the computer-crime, employer-data and privilege issues.
Read the worked answer
Consent to access a computer turns on actual or apparent authority over the device and over the specific files. A spouse's consent may cover a shared family computer, but this is an employer-issued laptop with an asset sticker, and the employer's data is not Dana's to authorize. Access that exceeds authorization can violate Nebraska's computer crime statutes (Neb. Rev. Stat. section 28-1343 et seq.) and the federal Computer Fraud and Abuse Act, and it invites civil claims for intrusion and for misappropriation of trade secrets under the Nebraska Uniform Trade Secrets Act. The strongest part of Dana's position is the cached personal email on a device in the marital home; the weakest is the engineering folder.
Privilege is a separate issue. Marital communications may be privileged, and the decision whether to use any of this belongs to counsel, not the investigator. The agency should have obtained written authorization from Dana and a written scope from her attorney before opening anything.
2. What should have happened before imaging, and how should the technician document the image now that it exists?
Read the worked answer
Before imaging: a written engagement letter identifying the device, the claimed basis of authority, the specific scope, and the custodian; a preservation letter or agreement with the husband's counsel on a protocol; and a forensic acquisition using a write blocker so the original is never modified. If counsel could not agree on a protocol, the safe course is to secure the device, not to browse it.
Now: stop analysis and document what already happened. Record the device make, model and serial number; the USB drive identifiers; who had possession and when; the acquisition date and time; the tool used; and SHA-256 hash values taken at acquisition and verified afterward. Photograph the device and any seals. Keep the original in a locked evidence locker with a chain-of-custody log listing every person who handled it. Work only from a verified copy. Note that the technician opened the email before the hash was taken, and document that sequence honestly rather than reconstructing it. Then refer the scope question to counsel.
3. How should the agency respond to the instruction to wipe the laptop and delete the employer's files?
Read the worked answer
Refuse both instructions and put the refusal in writing. Wiping the device destroys evidence, invites a spoliation claim in the divorce, may constitute obstruction, and would expose the agency to civil liability and a licensing complaint. The original should be preserved and returned only under a documented agreement with counsel, not secretly replaced before the husband gets home.
The employer's drawings should not be deleted either. They should be quarantined, documented and reported to Dana's attorney, because the employer may have rights in them and the contractor may have its own reporting obligations. The agency should not contact the employer unilaterally without counsel's direction. If Dana insists, the agency should confirm the instruction in writing, decline, and consider whether the engagement can continue. Preserving the record and telling counsel promptly is the only defensible path.