1. Which Digital Records Should a Company Preserve First?
Preserve records at risk of routine deletion or account closure. Define which systems, employees, and time periods are relevant to the suspected incident. The preservation scope should include information that could contradict the initial allegation.
Secure Account Activity and Access Permissions
Export sign-in, VPN, cloud, multi-factor authentication, and administrator logs with time zones and device identifiers. Retain employment agreements, access approvals, termination notices, and credential-disable dates. A successful login identifies account activity, but not necessarily the person responsible.
Trace File Movement and Possible Destinations
Collect file-audit events, sharing-link histories, email-forwarding rules, USB activity, and security alerts. Compare file versions, timestamps, and destinations. Routine synchronization or approved collaboration may explain an apparent bulk download. These records may later support a cybercrime investigation.
| Record | What It May Establish | Key Limitation |
|---|---|---|
| Sign-in logs | Account and device activity | Actual user identity |
| File-audit trails | Access or sharing events | External receipt |
| Email and device logs | Possible transfer routes | Intent to steal |
| Offboarding records | Changes in access rights | Actual file removal |
Sign-in logs
- What It May EstablishAccount and device activity
- Key LimitationActual user identity
File-audit trails
- What It May EstablishAccess or sharing events
- Key LimitationExternal receipt
Email and device logs
- What It May EstablishPossible transfer routes
- Key LimitationIntent to steal
Offboarding records
- What It May EstablishChanges in access rights
- Key LimitationActual file removal
2. How Can a Company Preserve Evidence without Altering It?
Investigators should retain original data and examine working copies. Opening a file, resetting an account, or restoring a backup can change technical records before anyone establishes what occurred.
Capture Native Files and System Images
Export logs in their original formats before retention periods expire. Qualified forensic personnel may image company devices and calculate cryptographic hashes to compare copies with preserved originals. Record collection tools, timestamps, clock differences, and processing steps. Matching hashes support data integrity but do not identify the person responsible for a transfer.
Document Collection and Chain of Custody
A collection record should identify:
- The collector and the method or tool used.
- The source device or account, collection time, and time zone.
- Storage locations for originals and working copies.
- Subsequent access, transfers, or examinations.
Limit access to original evidence. California Evidence Code §§ 1400–1401 establish authentication requirements for writings offered in state court, including electronic records. Company ownership does not eliminate applicable privacy restrictions. Investigators must establish lawful authority before accessing personal devices or accounts.
3. Which Legal Issues Matter before a Criminal Referral?
An internal alert may involve disputed computer access, confidential business information, or personal data exposure. Each raises different legal questions. Establish what happened before applying criminal or notification requirements.
Distinguish State and Federal Computer-Access Rules
California Penal Code § 502(c)(2) addresses knowing access followed by taking, copying, or using data without permission. Section 502(h)(1) exempts acts within the scope of lawful employment, including work reasonably necessary for assigned duties. The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, applies separate elements. Under Van Buren v. United States, an improper purpose alone does not establish exceeding authorized access when the person was entitled to obtain the information. A criminal assessment must distinguish prohibited system entry from misuse of accessible files.
Determine Whether Personal Information Triggers Notice
A confidential pricing model is not necessarily personal information covered by breach-notification law. California Civil Code § 1798.82 applies to qualifying breaches involving specified personal information acquired, or reasonably believed acquired, by an unauthorized person. For covered businesses that own or license the information, required notice generally must reach affected residents within 30 calendar days of discovering or receiving notice of the breach. Statutory delays may apply for law enforcement needs or necessary investigation and system restoration. When a qualifying breach requires notice to more than 500 California residents, the business must also submit a sample notice to the Attorney General within 15 calendar days after notifying affected residents. Criminal reporting does not replace these data privacy obligations.
4. What Should a Company Include in a Cybercrime Report?
A useful referral distinguishes verified events, unresolved questions, and steps already taken. Companies should not delay an urgent report solely to complete an internal forensic investigation.
Build a Timeline from Source Records
Identify the first alert, affected accounts, file activity, access changes, and containment measures. Distinguish system-generated timestamps from witness statements and investigator interpretations. Explain missing records or gaps caused by expired logs without speculating about their contents.
Choose the Reporting Channel and Preserve Supporting Records
The FBI's Internet Crime Complaint Center (IC3) accepts reports of suspected internet crime. Depending on the conduct, a company may also contact an FBI field office or appropriate state or local authorities. IC3 does not accept evidence attachments, so companies should retain original records for later requests. Document witnesses' firsthand observations separately from legal conclusions. Attorney involvement does not automatically make technical reports privileged. If proprietary information was involved, a separate trade secret assessment may identify potential civil remedies without assuming criminal liability.
5. Frequently Asked Questions
How Long Can Deleted Company Files Remain Recoverable After an Employee Leaves?
There is no uniform recovery period. Recoverability depends on storage technology, overwriting, cloud retention settings, and backup availability. Deleted files may remain in backups after disappearing from an active account, while some storage operations can permanently remove recoverable data. A forensic examiner can assess available sources without promising recovery.
Can a Company Sue While Police Investigate Suspected Data Theft?
Potentially. A criminal investigation does not automatically prevent a company from pursuing contract or trade secret claims. Each civil claim has separate legal elements and filing deadlines. Parallel proceedings may affect discovery, access to evidence, or court scheduling. The company should evaluate those procedural issues before choosing a litigation strategy.
6. When Should a Cyber Crime Law Firm Review the Evidence?
Expiring cloud logs, unresolved access permissions, or suspected exposure of regulated personal information may require early legal review. SJKP's attorneys can examine preservation gaps, limits in forensic findings, reporting options, and applicable notification duties before the company makes a formal allegation.
04 Nov, 2026
