By the time an employee hands in two weeks’ notice, the files they wanted are usually already gone. The resignation is the moment the company starts paying attention. The theft happened earlier, in the quiet weeks before anyone had a reason to watch.
Most companies run this backwards. The letter comes in, HR schedules the exit interview, IT queues the laptop for reimaging, and someone asks three weeks later whether the departing sales director took the account list to the competitor he just joined. By then the laptop has been wiped, the logs have rolled off their retention window, and the only proof left is a hunch.
The investigation that works starts from a different assumption. The data walked out before the person did. Find when, and you find everything else.
The resignation is the last event, not the first
People who take data on their way out follow a recognizable sequence. They decide to leave. They line up the next role. And somewhere in that gap, before the notice, they collect what they think they are owed: the client list, the pricing model, the source code, the deck they spent two years refining.
The collection is the part that leaves a trail. A sales director does not email himself 400 contact records on his last Friday and hope nobody notices. He does it on a Tuesday six weeks earlier, mixed into normal activity, when there is no open investigation and no reason for anyone to pull his logs.
That is why the resignation date is close to useless as an anchor. It tells you when the company found out. It tells you nothing about when the exposure happened. The real question is what changed in this person’s behavior in the 60 to 90 days before they gave notice, and almost no exit process ever asks it.
The behavioral markers that matter here overlap heavily with the ones that signal a problem long before anyone quits. The same access patterns that flag an insider threat while the employee is still on payroll are the ones that, read in hindsight, show you exactly when a departure turned into a data theft.
The trail lives in logs most companies never pull
The evidence exists. It sits in systems the company already runs and almost never reads.
Start with the obvious exfiltration channels. A USB mass-storage device plugged into a managed Windows machine writes a record. Windows Security Event ID 6416 logs an external device recognized by the system. File access to sensitive directories writes Event ID 4663 when object auditing is on. Microsoft 365’s Unified Audit Log records file downloads, SharePoint and OneDrive sync activity, and mailbox rule changes, going back 90 days on the standard license and up to a year on E5. Google Workspace keeps a parallel admin audit log with the same categories.
Then the quieter channels. A mailbox forwarding rule pointed at a personal Gmail address. A personal Dropbox or Google Drive client installed on the work machine and syncing a folder full of proposals. A sudden spike in print volume. Access to files outside the person’s normal role, the kind of lateral browsing that has no business reason behind it. Repeated off-hours logins from someone who has always worked nine to five.
None of these is proof on its own. A forwarding rule can be convenience. A USB event can be a phone charging. The signal is the cluster, read against the person’s own baseline. One employee pulling 30 gigabytes of files in their final two weeks, when their prior 90-day average was under two, is not an edge case you explain away. That is the case.
Reimaging the laptop destroys the case
The single most common way a company loses a trade-secret claim before it starts is by following its own IT policy.
Standard offboarding says collect the device, wipe it, reissue it. That policy is correct for an ordinary departure and catastrophic for a suspicious one. The moment the laptop is reimaged, the deleted-file remnants, the USB history, the browser download records, and the local sync artifacts are gone. A forensic examiner can sometimes recover fragments from a reimaged drive. More often the company has handed the departing employee the one thing they could not have taken themselves: the destruction of the evidence against them.
The discipline here is a litigation hold placed the instant a departure looks wrong, covering the laptop, the email account, the badge-access records, and the audit logs, before anyone touches a device. The log retention clock is the enemy. A 90-day audit window means a theft that happened 75 days before someone noticed leaves you 15 days to preserve it. Miss that, and the record that would have won the case simply ages out.
Preservation is also where most internal efforts quietly fail on admissibility. An IT manager who opens the laptop, browses the file history, and takes photos of the screen has not collected evidence. He has contaminated it. A screenshot does not survive the scrutiny a forensic image does, and the difference only shows up later, in a deposition, when it is too late to redo.
The timing of the investigation decides the outcome
Everything about these cases gets harder the longer you wait, and almost nothing gets easier.
Investigate before the confrontation. The exit interview where someone casually mentions they are “just taking a few personal files” is the moment the person learns whether anyone is watching. Confront too early, with suspicion but no evidence, and you teach them to delete the trail and lawyer up. Confront with a forensic timeline already built, and the conversation changes entirely.
The same logic that governs chasing money governs chasing data. Asset tracing works better before the lawsuit than after the judgment for the same reason data investigation works better before the wipe than after: the window where the evidence still exists and the subject is not yet defensive is short, and it closes on its own.
There is a cost calculation buried in this that executives tend to run too late. The forensic preservation of a single laptop and a mailbox, done by someone who can testify to the chain of custody, runs a few thousand dollars. The trade-secret litigation it supports, or the demand letter that makes litigation unnecessary, is worth multiples of that. The reimaged laptop that saved a four-hour IT ticket is what makes the whole claim unwinnable.
What the evidence has to survive
A data-theft investigation is only as good as what it can prove in a room where the other side is paid to tear it apart.
That shapes how the work gets done from the first hour. Forensic images, not file copies. A documented chain of custody for every device. A timeline built from system records rather than from anyone’s memory of events. Analysis that separates what the logs show from what the logs suggest, so that the inference is labeled as inference and never smuggled in as fact.
The output that holds up is written for the venue it will end up in. An investigative file assembled for a general counsel to skim reads very differently from one built to withstand cross-examination, and the gap between them is where cases are lost. The report has to be written for the deposition, not for the client, because the deposition is where it will actually be tested.
Here is a field test any company can run this week without hiring anyone. Pick an employee who left in the last 90 days, ideally one who went to a competitor. Pull their file-download and USB activity from the audit log for the 30 days before they resigned, and compare it to their own 90-day baseline before that. If the final month spikes, you have a problem you never investigated, and a process that would miss the next one exactly the same way.
The companies that win these cases are not the ones with the best lawyers. They are the ones who preserved the evidence before they knew they needed it.
Farsight Intelligence handles corporate investigations for attorneys, executives, and compliance teams who need to know what actually happened before they decide what to do about it. On the growth side, Florida Man Innovations builds the revenue systems that keep a business worth defending. If you are staring at a departure that does not sit right, the time to move is now, not after the laptop is wiped. Reach Brett at meet.brettfl.com or [email protected].
Before the notice, always.