Case Study: Forensic Email and Deleted File Analysis – Sexual Harassment

By: Bradley J. Bartram, Vice President of Information Technology & CTO

The Facts: 

ABC Company hired Jane to work in a unit of the company supervised by Jack.  After six months, Jane began missing work and eventually ABC Company terminated her employment.  Two days later, Jane’s attorney sent the Company a letter alleging sexual harassment by Jack.  During an internal investigation conducted by the company, it was learned that Jack had a history of sexually inappropriate conduct with the female employees in his unit.  Fortunately, the company hired an outside independent computer company which forensically escrowed a copy of Jane’s computer upon her termination.  A forensic image of Jack’s computer was also escrowed and examined as part of the sexual harassment investigation in preparation for litigation.

Forensic Findings:

The forensic examination of Jack’s computer revealed several deleted performance evaluations during Jane’s probation period.  The deleted reports indicated that she was a mediocre employee at best.  However, the actual performance evaluations located on the computer and ultimately submitted by Jack showed Jane as a stellar employee with the highest ratings available.   Jack also had several emails indicating a mutual sexual relationship between Jack and Jane.  The forensic examination of Jane’s computer showed an even more telling picture.  Located within several  forensically recovered deleted-deleted emails on Jane’s computer, were very sexually charged and proactive advances towards Jack.  The emails revealed that Jane sought out the relationship and was an eager participant in the conduct.  There was also evidence in the deleted emails that Jane had promised sexual favors in exchange for positive performance reviews during her probation period.

Risk Factors:

The Company was facing a significant sexual harassment claim by a female employee against a supervisor that, through investigation, was determined to have had “some” prior sexual harassment issues that the company should have been aware of.  These factors taken alone would have probably resulted in a very unfavorable settlement or verdict.

Bottom Line:

The Company was able to present the computer forensic information to the opposing counsel prior to the filing of a formal action and as a result, stopped the action dead in its tracks.  Had the company NOT had the forethought to forensically escrow, preserve and analyze the employee computers, they most certainly would have had to rely on standard IT data and investigative information and would have probably settled the action for a substantial amount of money.  The Forensic Image and Analysis of the suspect employee computers literally saved the company hundreds of thousands of dollars.

Comments/Questions for DIGITS LLC?

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s