// first 10 minutes

trade secret / IP theft — quick-start

trade secret theft — first 10 minutes. preserve before the endpoint is wiped. print this, check boxes, then run the primary tools.

checklist

do not reimage or wipe the departing employee's endpoint until forensic imaging is complete.
suspend but do not delete the employee's accounts — SSO, email, GitHub, cloud storage, VPN.
pull DLP alerts and audit logs for the user for the 90 days before departure — file copy, download, sync events.
export email send logs for large attachments or personal-address forwards in the departure window.
pull USB attach/detach events from Windows Event Log (System.evtx events 2003/2004) on the endpoint.
export cloud storage sync client logs — Dropbox, Box, OneDrive, Google Drive transfer histories.
identify all personal cloud and github accounts the employee had access to from corporate device — browser history artifacts.
preserve HR off-boarding documentation and any nondisclosure, non-compete, or IP assignment agreements.
note the scope of the alleged theft: file count, project names, customer lists, source code repos.
begin the primary tool path below — DLP correlation engine and USB artifact analyzer.