MATTER TYPE / EMPLOYMENT

Employment and departing employees: what the access record attributes, and to whom

Employment matters run on authentication and access records — which credential authenticated, from where, to what, and in what order. The examination is usually straightforward. The pressure is on the two sentences that follow it: that the account was the employee, and that the access was unauthorised. Neither is a forensic finding by itself.

QUESTION: What the account reached, and when
CORE ARTIFACTS: 4624 · sign-in logs · audit log
CLOCK: Endpoint telemetry ages out in weeks
USUAL POSTURE: Injunction, then merits discovery
DELIVERABLE: Declaration, then Rule 26 report
ROLES: Testifying · Consulting · Neutral

IN SHORT

In an employment dispute the forensic record normally establishes which account authenticated, from what machine and address, what it reached, and in what sequence relative to the resignation. It does not establish who was at the keyboard, and it does not establish that the access exceeded authorisation — the first needs corroboration from outside the machine, and the second is a question about the permissions the employer configured and the agreements it wrote.

What is actually in dispute

Almost every employment matter with a digital component reduces to two propositions — that a particular person did a particular thing on a system, and that they were not entitled to — and the forensic record speaks directly to neither.

What it speaks to is the middle: an account authenticated, a resource was reached, a file was opened, a query returned rows, a share was enumerated. Those are observations. The step from observation to “the plaintiff did this” and the step to “and had no right to” are separate inferences, drawn from different material, and a report that runs all three together is offering one finding where it has evidence for one third of it.

The matters arrive in several shapes. A departing sales director whose successor cannot find the pipeline. A restrictive-covenant action where the question is what the employee took with them in their head and what they took in a folder. A misconduct termination challenged as pretextual, where the employer’s own logs are the evidence and the employee’s expert is reading them for gaps. A counterclaim alleging the employer monitored a personal account. Different postures, one evidentiary centre of gravity.

Authorisation is a legal question with a technical input

Whether an employee exceeded authorised access is decided on the employer’s policies, the employment agreement, and — this is the part an examiner supplies — the permissions actually in force on the system. Those two things diverge constantly. A policy says finance data is restricted; the access control list says the whole domain users group can read it. A handbook forbids personal cloud storage; the endpoint has no control preventing it and the proxy never blocked the domain.

The federal computer-misuse statute made that gap decisive. In Van Buren v. United Statesthe Supreme Court read “exceeds authorized access” under the Computer Fraud and Abuse Act to cover obtaining information from areas of a system the person is not entitled to reach at all — a gates-up-or-gates-down enquiry — rather than covering an entitled user who accesses permitted material for an improper purpose. What that decision did to forensic practice is concrete: the useful question is no longer “why did the account open this” but “was this account permitted to open this, and how do we know”. The answer comes from group memberships, folder permissions, role assignments and tenant policy as configured on the date in question, and those are records that can be preserved and read like any other.

Which artifacts bear on it

Three layers keep authentication and access records, and a finding that appears in only one of them is weaker than a finding that appears in all three. Corroboration across layers is most of the method here.

The endpoint

Windows logon events record successful and failed authentication with a logon type that distinguishes an interactive session at the console from a network session, a service, or a cached credential — a distinction that frequently decides whether someone was physically present. Remote desktop artifacts record inbound and outbound sessions with their source. On the activity side, UserAssist counts GUI-launched programs per user, RecentDocs and jump lists record documents opened, and browser history and download records record where a session went and what it retrieved.

The domain and the tenant

Domain controller security logs carry the authentication half of the same events from the other side of the wire, which is what makes them the check on a workstation whose local log has rolled. Entra ID sign-in logs record cloud authentications with application, device, address, conditional-access result and multi-factor state, and the Microsoft 365 unified audit log records what happened afterwards — mailbox items opened, files downloaded from a site, sharing links created, forwarding rules added. A mail rule quietly forwarding to a personal address is one of the few findings in this matter type that is nearly self-proving.

The security stack

EDR telemetry and process creation events record execution with command lines and parent processes, which is how an archiving utility run against a network share at 11pm becomes visible at all. Both are also the shortest-lived records in the matter: retention on an endpoint platform is a licence tier, and it is routinely measured in days.

Limits of proof

What this evidence cannot establish

That the employee was the person at the keyboard. A logon event records that a credential was presented. Shared passwords, saved sessions, an unlocked workstation, a delegated mailbox and an administrator acting on a user’s behalf all produce records indistinguishable from the custodian’s own. Attribution comes from badge records, video, phone records or an admission, and the report should name which was available.
That the access exceeded authorisation. An examiner can report what the permissions permitted and what the account did. Whether that was authorised is decided on the policies and agreements, and the two frequently do not match. An opinion that access was “unauthorised” states a legal conclusion in forensic clothing.
That an address identifies a device or a location. An address is shared across an office, translated across a carrier’s subscribers, rented from a VPN provider, and reassigned. It can show that a session came from outside the corporate network or that two sessions shared an origin. It does not name the machine or the person without records from whoever assigned it.
That nothing happened, where the record is silent. Much Windows auditing is off by default, endpoint telemetry rolls within days on some licences, and cloud audit retention is a configuration somebody chose years ago. Absence has to be tested — was the logging on, was the window still open — before it is reported as a finding.
Motive, pretext, or whether a policy was fair. Activity clustering in the fortnight before a resignation is a pattern worth stating precisely and dating carefully. Whether it was preparation, ordinary work, or a response to something the employer did is not a question artifacts answer, and an expert who answers it has left the discipline.

Where the disputed messages are on a personal phone rather than a company machine — group chats, deleted texts, a recording made during a meeting — that is a different acquisition discipline and is covered at mobileforensicexpertwitness.com. The tool at can this artifact prove that? maps a proposition onto the records that bear on it and shows where the inference runs out.

The expert’s role and the deliverable

Preservation, before reissue. The workstation before it is wiped for the next hire, the mailbox before the licence is released and the account is deleted, tenant sign-in and audit records while they are inside their retention window, and the endpoint platform’s telemetry first, because it goes first. The preservation deadline calculator exists for this step.
Capture the permissions as they stood. Group memberships, folder and share permissions, role assignments, conditional-access policy and mailbox delegation are live configuration that changes after an exit. Exported at the time, they answer the authorisation question later; reconstructed afterwards, they are argued about.
Acquisition under write-block. Devices imaged to E01 or raw, hashed at acquisition and again at verification, with a custody form that becomes an exhibit. Server-side and tenant records collected through documented export or API, with the query and its date range recorded so the collection is reproducible.
A timeline that names its sources. Endpoint, domain and tenant clocks are separate clocks. A normalised timeline states the time zone it is rendered in, the offset applied to each source, and which entries corroborate each other rather than merely appearing near each other.
The Rule 26(a)(2)(B) report, or a declaration on an injunction schedule. Opinions with basis and reasons, facts and data considered, exhibits, qualifications, a four-year testimony list, and compensation. Findings that cut against the retaining party are recorded the same way as the rest.
Rebuttal and testimony.In employment matters the rebuttal is often the whole engagement: taking an opposing examiner’s attribution apart, or testing whether the gaps they call suspicious are gaps in conduct or gaps in logging.

How the report is scoped, disclosed and defended is set out on the expert witness testimony page. The examination itself is described on the computer forensics and server forensics pages, and the tenant side on cloud forensics.

Where Rule 702 pressure falls here

Under Rule 702 as amended on December 1, 2023, the proponent must show it is more likely than not that the opinion reflects a reliable application of the method to the facts of the case. In employment matters the method is rarely contested. The attribution is.

The account named as the person. A report that writes “the plaintiff logged in at 22:41” where the record says a credential authenticated has already conceded the cross-examination. Writing it as the account costs nothing and holds.
Authorisation stated as a finding. Opining that access was unauthorised, or that conduct violated a statute or a covenant, invites exclusion regardless of how sound the underlying reading of the logs was. The reading of the logs survives; the conclusion drawn on top of it does not.
Gaps offered as evidence of concealment. A missing interval in a log is a fact about the log. Presenting it as deliberate suppression, without establishing that the logging was on, retained, and covering that machine, is the single easiest opposing argument in this matter type.
Unnormalised timelines. Domain controllers, workstations and cloud tenants record in different zones and drift independently. A sequence that proves a point only after the offsets are applied has to show the offsets.
Statistical framing of ordinary activity. “Access spiked 400%” is a claim about a baseline, and a baseline needs a defined comparison period, a defined population, and a stated source. Without those it is a rhetorical figure that an opposing expert will recompute.

The Daubert Docket collects rulings on digital forensic testimony; the Daubert exposure check walks an opinion against the same failure modes before it is served, and the guide to Daubert challenges to digital evidence sets out the framework.

RECORD	WHAT IT ESTABLISHES	WHAT IT DOES NOT ESTABLISH
Windows logon events	That a credential authenticated to a machine, with logon type, source and time — including whether the session was interactive or network	Who presented the credential. Shared passwords, unlocked consoles and delegated access all look identical
Domain controller security log	The authentication seen from the other side of the wire, surviving after a workstation log has rolled	Anything about what the session then did on the endpoint
Entra ID sign-in logs	Cloud authentication with application, device, address, conditional-access outcome and multi-factor state	The physical location of the user. Address and device fields are what was presented, not what was verified
Microsoft 365 unified audit log	Mail and file operations after sign-in — items opened, files downloaded, sharing links created, forwarding rules added	Content. It names an operation on an item, and retention is a licence and configuration question
UserAssist and RecentDocs	That a program was launched or a document opened, per user account, through the shell	Whether anything was read, changed or copied; absence does not show a file was never opened
EDR telemetry and process creation events	Execution with command lines and parent process, which is how scripted or bulk activity becomes visible	That the endpoint was covered at all on the date in question, and retention is frequently days
Permission and group exports	What the account was entitled to reach on the date the export was taken	What it was entitled to reach at any earlier date, unless change history was retained

The right-hand column is the one that decides Rule 702 motions in this matter type. Each record above has its own page under /artifacts setting out retention, failure modes, and how a finding drawn from it is attacked.

Questions counsel ask

Can you tell us who was actually using the account?

The records name an account and a session, and that is a narrower fact than it sounds. A logon event identifies the credential presented, the machine, the logon type and the source; it does not identify the human being. Attribution to a person is built from corroboration outside the machine — badge and door records, video, a phone on the same network, a call that overlaps the session, an admission in a deposition — and where none of that exists the honest report says the account, says what the account did, and stops there.

Our IT director says the employee accessed files he had no business in. Is that a forensic finding?

Half of it is. That an account opened a document, browsed a share, or ran a query is a forensic finding drawn from access records. Whether the employee was entitled to do so is a question about policy, role, contract and the permissions the company itself configured, and an examiner answers it only by reading back what the access control lists and group memberships actually permitted on the date in question. That distinction matters more than it used to, because the federal computer-misuse statute now turns on whether the gate was open rather than on why the person walked through it.

There is no evidence of anything in the logs. Does that mean nothing happened?

Not on its own. Windows security auditing ships with much of its useful detail switched off, endpoint execution artifacts are capped and roll over, cloud sign-in and audit records are kept for a period the tenant licence and configuration decide, and a workstation left in service overwrites its own history. Before silence is offered as a finding it should be tested: was the audit policy enabled, was the retention window still open on the dates that matter, and was the machine or account even in scope for the logging in question.

The employee used a VPN. Does the IP address tell you where he was?

It tells you which network egress point the traffic appeared to come from at that moment. An address may be shared by an entire office, translated across thousands of subscribers, assigned by a commercial VPN provider, or reassigned an hour later. An address can support an inference — that a session came from outside the corporate network, that two sessions shared an origin, that a sign-in appeared from a region the custodian has never worked in — and it does not name a device or a person without records from the party that assigned it.

How does this differ from a trade secret examination of the same laptop?

The device is often the same and the question is not. A trade secret examination asks what left the machine and by which route, so it centres on removable media, sync clients and mail. An employment examination usually asks what an account reached and whether it was entitled to, so it centres on authentication records, permissions and the sequence of access. The two are frequently run together on one image, and the report should say which findings answer which question rather than blending them.

How fast do we need to move on preservation?

Before the machine is reimaged and reissued, which in many organisations happens within days of an exit interview. Preservation covers the workstation, any device already returned, the mailbox and its retention settings, the tenant sign-in and audit records, and whatever the endpoint security platform holds — that last one often has the shortest window of all. The step is independent of whether anyone has decided to retain an expert, and it is the step that determines what an expert can be asked later.

Trade secret litigation
The same departure read for exfiltration rather than access — removable media, sync clients, and the gap between attachment and transfer.
Server forensics
Domain controllers, file servers and application logs — where the authentication record survives after the workstation has been reissued.
Windows logon events
Logon types, what each one actually means about physical presence, default audit policy, and how the artifact is attacked.
How to hire and vet a forensic expert
Testifying versus consulting versus neutral, what to demand before retention, conflicts, timing, and cost.

ENGAGE AN EXPERT ON AN EMPLOYMENT MATTER

Workstations are reimaged for the next hire, mailbox licences are released, and endpoint telemetry rolls off on a schedule set by a licence tier. Send the matter, the venue, the separation date, and where the machines, mailboxes and tenants sit — a conflicts check and a scoping call follow.

START A CONFLICTS CHECK→

DIRECT → info@lawandforensics.com·855-529-2466

A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.

Attorney advertising / expert services. This page describes forensic practice and the procedural rules that govern expert evidence in general terms. It is not legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum. Prior results do not guarantee a similar outcome.