Remote Laptop, Personal Cloud, and Legal Hold
HR reports a remote sales employee may have copied 8,000 customer contact records to a personal cloud drive before resigning. The employee's corporate laptop is powered on, connected to VPN, and BitLocker-encrypted; the user is cooperative and asks to keep working. Legal has issued a preservation notice but no warrant. Company policy permits monitoring on company devices; the employee is in Germany. The laptop has a 512 GB SSD with 60 GB free. The SOC has a forensic workstation and a write blocker, but no licensed mobile forensic tool for the cloud service. The employee's manager wants the laptop back immediately for a replacement hire. You have four hours before the employee's exit interview.
1. What should you collect first and why? Address order of volatility.
Read the worked answer
Collect volatile data first while the laptop is powered on and connected: running processes, network connections, logged-in sessions, mounted cloud drives, browser tabs, clipboard if policy allows, and memory if the forensic tooling supports BitLocker-unlocked acquisition. Do not shut down or let the user continue working; both change state. Next, preserve the disk with a write blocker and create a verified image with hash values. Because BitLocker is active, coordinate with IT for the recovery key under legal hold and document who accessed it. Collect cloud-service logs through the company's SaaS administration and the vendor's legal process, not from the user's browser. Photograph the device, label cables, and record times. The manager's request for immediate reuse is lower priority than preservation; provide a replacement laptop from stock instead. Chain of custody starts at first contact, not at imaging.
2. How do you handle the employee's cooperation and privacy constraints in Germany?
Read the worked answer
Handle the German privacy constraints through legal and the DPO/works council, not by relying on the employee's cooperation alone. Company policy may permit monitoring on company devices, but proportionality and employee-notification rules still apply. Limit collection to data relevant to the suspected exfiltration, such as cloud upload logs and recent file access, rather than reviewing personal content wholesale. Document the legal basis and the scope decision. The employee's willingness to cooperate does not waive legal protections or make the evidence automatically admissible. Tell the employee that the device is preserved for investigation and provide a replacement; do not ask them to delete anything. If the exit interview proceeds, keep it separate from forensic questioning and have HR and legal present. Escalate any request to search personal accounts to legal.
3. What documentation makes the evidence defensible?
Read the worked answer
Defensible documentation includes: collector identity and qualifications; date, time, and time zone for every action; device identifiers and serial numbers; hash algorithm and values for images; tool names and versions; write-blocker details; photographs of the device and connections; chain-of-custody form with every transfer, signature, and seal number; storage location and access log; and notes on any deviation, such as BitLocker key access. For cloud evidence, record the API or admin-console export method, account identifiers, query parameters, and hashes of exported files. Keep a working copy and an evidence copy; analyze only the working copy. If a step was not forensically ideal, document it rather than hiding it. The goal is continuity and reproducibility, not perfection.