Performing data and digital forensics investigations for more than three decades on over 15,000 computers, disk drives and other digital media...
Employee Termination
Procedure for Securing a Device or Tips when an Employee leaves.
-
Make sure the employee returns all digital media such as laptops, PDAs, thumb/jump drives, etc immediately.
-
Do not let the employee return to the computer.
-
Immediately remove the computer from operation and store it in a secure location with limited access; DO NOT access the computer looking for data.
-
If the computer is on, pull the power plug from the back of the computer; DO NOT shutdown the computer using the Windows menu.
-
Make a note of the name of the person that was using the computer and general location such as a department/city/state.
-
Make a note of the person that removed the computer (Name / Position / Date / Time / Reason).
-
Make a note of where the computer is being stored (Must be secure and have limited access).
-
Call us for imaging of the hard drive (so you at least have an image of the hard drive, even if you choose not to proceed.)
-
Once the image is completed; the machine may be put back into circulation if the client chooses, or returned to a secure location.
-
Remove employee access to all programs, websites, e-mail as well as physical access to the building.
Call us at 866.237.0454