Describe some of the forensic processes involved in investigating an employee suspected of industrial espionage.

Question

What will be an ideal response?

Answer 1

Before initiating this type of investigation, make sure the company, whether it's a private organization or a public agency, has set up rules of use and limitations of privacy rights. For these investigations, you might need to set up a surveillance camera to monitor the employee's activities in the office. You might also need to plant a software or hardware keylogger (for capturing keystrokes remotely), and you need to engage the network administrator's services to monitor Internet and network activities. In this situation, you might want to do a remote acquisition of the employee's drive, and then use another tool to determine what peripheral devices have been accessed.