So I must first Image it and then keep it in a safe place right ?
You should always examine a copy /image of the original evidence. Keeping it in a safe place is just part of maintaining a good chain of custody record.
A couple of notes, the fastest imaging speed you are likely to achieve is around 3GB/minute with SATA to USB so keep that in mind when you start.
If you hope to use this "evidence" in any sort of legal proceeding you will need to document every step from the time you remove the drive from the computer where it currently resides to when you return it.
No matter what you are going to have an uphill battle.
Anyways now Ive got the permission to take the hard drive home and work on it .So I must first Image it and then keep it in a safe place right ?
Is this all real? I mean everything is backwards from the way that almost everyone here knows and operates. Why are you having to find out if someone stole from you? Shouldnt you have some backing from the company you work for.
Also is there any way to get access to his hard drive as well? If you could image that you could look for the file that may have been stolen. If it is a file that he shouldnt have access to, or that hashes out to the same as one on your computer you could be in a better spot.
Okay the main reason i have to do this work myself is
1.The company is small about say 30-75 emplyees
2.The people suspected include 2 employees and 3 outsiders
3.The security camera is not there inside this particular room because its services are rented out often and it could enable copying of their intellectual property
And No there wont be any legal procedure as far as i know it will be to the decision of one of the directors what is to be done
What we fear might have been taken are designs.Image files and video
Copied into the hard drive of the computer or to an external thumb drive
Well, you need to find a way to get all of the storage mediums collected from any possible suspect custodian. You then will image, and analyise the data. From there a bigger picture may (or may not) start to come together.
They have had to much time and The Hard Drive is the only chance Ive got its been with me since three days .There is a new hard drive in the studio .Now i just need to be able to put this together I really need youre help Now more than ever.Im doing my homework too