Information Governance & Data Privacy Consulting

Departing Employee Data Theft Consulting

Home·Areas of Expertise·Digital & Data·Information Governance & Data Privacy Consulting

We deliver expertise in developing proactive employee departure protocols and provide guidance in data proliferation response and remediation.

Our experts in digital forensics, data privacy, and information governance deliver strategic advisory regarding the implementation and/or enhancement of departing employee procedures, monitor and flag potential indicators of risk, preserve and analyze sensitive data accessed by departing employees, and deliver defensible remediation services in cases of data flight.

Contact Us
Our Services
  • Best Practice Policy Development
  • Compliance & Regulatory Program Implementation / Enhancement
  • Data Analysis – External Transfers, Document Access, Deletion Activity, Software-Specific
  • Data Privacy & Security Protocols Implementation / Enhancement
  • Data Proliferation & Flight Prevention
  • Document Recovery
  • “Near-Duplicate” Document Assessment
  • On-Premises Index & Search
  • Recovered Document Purge / Transfer
  • Source Data Preservation
  • Timeline Development & Analysis
Our Professionals
  • Certified CISO – Chief Information Security Officer
  • CIPM – Certified Information Privacy Managers
  • CIPP – Certified Information Privacy Professional
  • CISM – Certified Information Security Managers
  • CISSP – Certified Information Systems Security Practitioners
  • Compliance, Sanctions & Regulatory Experts
  • Cyber Security & Investigations Experts
  • Data Analysts
  • Digital Forensics Experts
  • Equipment Consultants
  • Former Federal Law Enforcement Agents
  • Former Prosecutors & Attorneys
  • IAPP – International Association of Privacy Professionals
  • Network Security Experts
  • Risk Advisory & Compliance Experts
  • Technology Consultants
Proactive Measures

We have significant experience assisting organizations and law firms operating on behalf of organizations in proactive measures, such as drafting best practice policies, incorporating aspects of data privacy and/or security protocols where warranted, or offering recommendations to minimize unwanted data flight. Our team works closely with internal stakeholders to understand existing policies and procedures, which help to formulate newly-created recommendations and guidelines or enhance existing procedures to adhere to industry-specific compliance or regulatory requirements.

Responsive Services

In situations when data flight has been discovered, our global team of data preservation experts are deployed to ensure source data is defensibly preserved with the appropriate chain of custody and related documentation. Our examination quickly identifies inappropriate data access, transfers, copies, and/or deletions. Subsequent analysis may include:

  • Identifying potential data transfer to external media - USB devices, thumb drives, cloud applications, and attachments to personal webmail messages, as well as sensitive or proprietary information sent via chat communications or saved locally to mobile devices
  • Analyzing system registry, event logs, and other related artifacts including recently accessed documents and/or “link” files
  • Deletion activity that may indicate efforts to obfuscate data transfers
  • Analyzing installed software and/or applications, particularly wiping tool applications
  • Deeper-dive document recovery from unallocated and/or slack space
  • Timeline and other analysis of specific application activity
  • Source code analysis to identify indications of source code theft or plagiarism of proprietary code
  • Use of advanced analytics, eDiscovery platforms, and tools such as large-language models, to inform more complex investigations
Remediation

Depending on our analysis, our services include remediation efforts to identify the extent of data proliferation to outside parties. Based on the scale, this process may include the implementation of on-premise indexing and searching, as well as the assessment of “near-duplicate” documents to aid in identifying IP/trade secrets. Once identified, exfiltrated data can be defensibly purged or securely transferred back to our clients, utilizing a combination of automated and custom methodologies.

Featured Engagement:
Large-Scale Remediation Engagement Involving a Tech Start-Up

As part of a settlement agreement, our team developed a workflow that involved in-place searching of network file servers for specific data types based on key metadata attributes and related criteria using custom scripting tools. We followed this process with targeted defensible purging and quarantine of select documents, including identifying and remedying documents residing within email systems and related archives.

Featured Engagement:
IP Theft Investigation Involving a Fintech Firm

Coordination with client IT to perform surreptitious remote data preservation of electronic records, including data captures after normal business hours. The analysis uncovered evidence to support the client’s allegations of unauthorized and fraudulent data transfers. Key findings included confidential documents retrieved from an iPad’s hidden Dropbox backup directory and the match of metadata attributes with other recovered artifacts.

Featured Engagement:
Trade Secrets Theft Investigation Involving a Life Sciences Company

Oversaw efforts for a Puerto Rico-based client that revealed the transfer of stolen trade secrets and intellectual property, uncovered by matching web-server log entries with internet-browsing activity on suspect computers, among other findings.

Featured Engagement:
Allegation of Data Exfiltration Involving a Financial Services Company

Our digital forensics expert analyzed data flight and threat-actor activities in an IT infrastructure environment while performing live memory capture and analysis via Volatility. Findings revealed that remote login sessions and document transfers by unauthorized international users. Security measures were recommended and implemented to ensure the environment avoids additional data flight, among other remediation steps taken.

RELATED SERVICE AREAS Click the icon to view the directory
 
Find Your Expert
Find Your Expert

Departing Employee Procedures, Advisory & Remediation

Related Insights

Our insights cover a variety of topics impacting businesses, society, the economy, and the environment. Check out our latest white papers, research reports, educational seminars, industry speaking engagements, and perspective articles.

Perspectives
Fidelity Investigations: A Comprehensive Guide to Successful Claims Outcomes
Perspectives
Off-Channel Communications: How Financial Services Organizations Can Address Regulators’ Latest Target
Perspectives
Safeguarding Cloud-Based Data & Mitigating the Cyber Risks Associated with a Remote Workforce
View All Insights
 
INDUSTRY INSIGHTS
Keep up with the latest research and announcements from our team.
Back to top
J.S. Held

Headquarters

50 Jericho Quadrangle
Suite 117
Jericho, N.Y. 11753
+1 516 621 2900
[email protected]

Media Relations

Contact: [email protected]

Subsidiary Firms

Contract Administration Associates, a J.S. Held Company

DBSConsult, a J.S. Held Company 
 

JS Held Malaysia Sdn. Bhd. | Registration No. 202001033278 (1389599-P)

J.S. Held Engineering Services PLLC

J.S. Held Singapore Pte. Ltd. | Registration No. 202032700W

J.S. Held UK Limited

J.S. Held India Private Limited

Ocean Tomo, a part of J.S. Held
 

California Architecture & Engineering services are provided by J.S. Held Engineering and Architecture, Inc., a wholly owned subsidiary of J.S. Held LLC

J.S. Held, its affiliates and subsidiaries are not certified public accounting firm(s) and do not provide audit, attest, or any other public accounting services. J.S. Held is not a law firm and does not provide legal advice. Securities offered through PM Securities, LLC, d/b/a Phoenix IB, a part of J.S. Held, member FINRA/ SIPC or Ocean Tomo Investment Group, LLC, a part of J.S. Held, member FINRA/ SIPC. All rights reserved.

Member FINRA | SIPC
J.S. Held

Headquarters

50 Jericho Quadrangle
Suite 117
Jericho, N.Y. 11753
+1 516 621 2900
[email protected]

Media Relations

Contact: [email protected]

Subsidiary Firms

Contract Administration Associates, a J.S. Held Company

DBSConsult, a J.S. Held Company 
 

JS Held Malaysia Sdn. Bhd. | Registration No. 202001033278 (1389599-P)

J.S. Held Engineering Services PLLC

J.S. Held Singapore Pte. Ltd. | Registration No. 202032700W

J.S. Held UK Limited

J.S. Held India Private Limited

Ocean Tomo, a part of J.S. Held
 

California Architecture & Engineering services are provided by J.S. Held Engineering and Architecture, Inc., a wholly owned subsidiary of J.S. Held LLC

J.S. Held, its affiliates and subsidiaries are not certified public accounting firm(s) and do not provide audit, attest, or any other public accounting services. J.S. Held is not a law firm and does not provide legal advice. Securities offered through PM Securities, LLC, d/b/a Phoenix IB, a part of J.S. Held, member FINRA/ SIPC or Ocean Tomo Investment Group, LLC, a part of J.S. Held, member FINRA/ SIPC. All rights reserved.

Member FINRA | SIPC
Areas of Expertise
 
Technical & Scientific Strategic Advisory Financial Investigations, Valuation & Risk Digital & Data
Markets We Serve
 
Aerospace & Aviation Agriculture Cannabis Construction Consumer Products & Services Cyber Education Energy & Power Financial Services Food & Beverage Government Healthcare Industrial & Manufacturing Insurance Private Equity Real Estate Retail, Restaurant & Hospitality Technology, Media & Telecommunications Transportation Infrastructure
Insights
 
White Papers & Research Reports Perspectives Educational Seminars & Events
About Us
 
Culture & Careers Our Experts Our Locations Leadership News Contact Us
Our Experts
close Created with Sketch.
Choose your language
Choose your region
Select Location · Submit Assignment · Search
 
Home Areas of Expertise Markets We Serve Insights About Us Our Experts