The forensic window after a key employee resigns is measured in days, not weeks. The longer counsel waits, the more standard IT processes overwrite the evidence litigation will turn on.
Within the first 72 hours, this is the practical sequence:
Hour 0–4: Issue preservation. Send a written preservation notice to IT covering the employee's laptop, mobile device, email, cloud-storage accounts, and any other devices that touched company systems. The notice should explicitly prohibit re-imaging or returning the laptop to inventory.
Hour 4–24: Forensic acquisition. Image the laptop and mobile device under chain-of-custody. Capture email exports and cloud-account snapshots. If the employee returned the device clean, the forensic-imaging step is even more critical — wiping evidence is itself evidence.
Hour 24–48: Triage analysis. USB activity, cloud upload patterns, email forwarding, bulk download events, file-deletion patterns, secure-deletion tool usage. The goal is identifying whether further investigation is warranted.
Hour 48–72: Counsel briefing. A practical summary of what the artifacts show. Often this is enough to either close the matter or to escalate it to formal forensic analysis supporting a TRO or preliminary injunction.
Time is the enemy of this work. Counsel who waits a week is starting at a deficit. We accept these matters on same-day terms.