Hi. I’m seeking for some opinions. I am attached to a local banking company in Malaysia. Recently one of my ex-staff in the Customer Relation department has left the company with less than 24 hrs notice resignation. Other staffs were perplexed and also kept thinking about why. Someone has taken his own initiative to check his computer station (I’m not quite sure that guy was doing) but he suspects there could have been some data from has been stolen. All panicked. How can we investigate that possibility? What information we should look into? Is there any quick way to prove something of data theft possibility? The nightmare is, worst case scenario, he has copied some of confidential data of high customer profiles and could have sold it. Should we invite computer forensic team from local enforcement agencies or we do it the 'forensic' thing?
Beatrice, cases like this one go to a court with a pretty high probability. So every step should be taken with great care and I can tell you from a country far away, that it was a BIG mistake, that your colleague has started his own investigation!
I strongly recommend the following things
- never touch this device again with any finger, only with gloves
- lock it until a Forensic Expert arrives
- contact your legal department and check the regulations, if you have to call the Police now
- hand the device over to an Expert in Digital Forensics
- work closely with Compliance, Data Privacy, Law and the HR team in your bank
Good luck!
Yes, call the Police NOW - not tomorrow! Dont forget to cut the internet access of your WAN router.
Hi. I’m seeking for some opinions
I can offer one opinion. And that is that you really took your sweet time asking that question. You joined May 4, and waited until May 8?
On May 4th you posted the exact same question over at Computer Forensics World. Noone answered. And here you are, four days later, asking exactly the same question again. The situation must really be stable if nothing revelant changed for four days. I would have expected you to gather your wits and talk with your legal department in the bank since then.
So … here's another opinion I don't believe this. I think you're trying to cheat on an exam or on some paper.
This response probably goes counter to some recommendation to be corteous to newbie posters. No matter. I don't mind feeding crims information as long as it is feed for someone elses mind and work, too. But I do mind feeding cheaters.
Hi. I’m seeking for some opinions
On May 4th you posted the exact same question over at Computer Forensics World.
Sorry, i gave here some digital food. Should have checked that before… a lazy student from Malaysia again.
a little bit frustrated,
Robin
With immediate effect I will no longer support Newbies. eTrust misused.
I would not be surprised if the case in question were the M57.BIZ, or a similar one, used for teaching and learning purposes.