By: Bradley J. Bartram, Vice President of Information Technology & CTO
ABC Company hired Jane to work in a unit of the company supervised by Jack. After six months, Jane began missing work and eventually ABC Company terminated her employment. Two days later, Jane’s attorney sent the Company a letter alleging sexual harassment by Jack. During an internal investigation conducted by the company, it was learned that Jack had a history of sexually inappropriate conduct with the female employees in his unit. Fortunately, the company hired an outside independent computer company which forensically escrowed a copy of Jane’s computer upon her termination. A forensic image of Jack’s computer was also escrowed and examined as part of the sexual harassment investigation in preparation for litigation.
The forensic examination of Jack’s computer revealed several deleted performance evaluations during Jane’s probation period. The deleted reports indicated that she was a mediocre employee at best. However, the actual performance evaluations located on the computer and ultimately submitted by Jack showed Jane as a stellar employee with the highest ratings available. Jack also had several emails indicating a mutual sexual relationship between Jack and Jane. The forensic examination of Jane’s computer showed an even more telling picture. Located within several forensically recovered deleted-deleted emails on Jane’s computer, were very sexually charged and proactive advances towards Jack. The emails revealed that Jane sought out the relationship and was an eager participant in the conduct. There was also evidence in the deleted emails that Jane had promised sexual favors in exchange for positive performance reviews during her probation period.
The Company was facing a significant sexual harassment claim by a female employee against a supervisor that, through investigation, was determined to have had “some” prior sexual harassment issues that the company should have been aware of. These factors taken alone would have probably resulted in a very unfavorable settlement or verdict.
The Company was able to present the computer forensic information to the opposing counsel prior to the filing of a formal action and as a result, stopped the action dead in its tracks. Had the company NOT had the forethought to forensically escrow, preserve and analyze the employee computers, they most certainly would have had to rely on standard IT data and investigative information and would have probably settled the action for a substantial amount of money. The Forensic Image and Analysis of the suspect employee computers literally saved the company hundreds of thousands of dollars.