When is a corporate internal digital investigation needed?
- When an employee who has left or is about to leave is suspected of exporting data such as customer lists, quotations or technical documents.
- When it is noticed that data has been mass-deleted or conversations wiped on a company phone or computer.
- When there are allegations of improper communication from a company line or device.
- When allegations in an internal investigation need to be technically verified or refuted.
Main service page for this topic: digital evidence examination
Legal framework: company policy, data protection and informing the employee
The examination is carried out only on devices owned by the company and issued for work purposes. There must be a written device use policy, the employee must have been informed in advance about this policy and possible monitoring, and the examination must be limited to its purpose.
From a data protection (KVKK) perspective, the examination is restricted to data relevant to the suspicion; the employee's unrelated private messages and photos are not accessed. An employee's personal phone is not examined without their explicit consent. The legal assessment is made by your company's legal department or lawyer, and the technical examination is planned accordingly. Rules in other countries differ and should be clarified with a lawyer.
How does the investigation proceed?
- Initial meeting with the legal department: The suspicion, the devices to be examined and the scope of the data sought are put in writing.
- Securing the device: The device is taken out of use; it is not switched off, reset or loaded with new apps.
- Documentation: A handover record is drawn up, a SHA-256 hash of the acquired data is recorded and all work is done on a copy.
- Scope-limited examination: Only files, app data and traces related to the defined matter are examined.
- Report: Methods, tools, findings and limitations are delivered to your legal department in writing.
What can be looked for in suspected data leakage or deletion?
On phones and computers, app databases, file system records, recently opened files and cloud sync traces can be examined. The chance of recovering deleted files depends on the device, encryption and how much the device was used after deletion; on current phones, recovery from raw storage is often not possible.
Backups and cloud records linked to company accounts can hold more traces than the device itself. For the technical limits of deleted data recovery, see the recover deleted data from a phone page.
Reporting and limitations
Findings are reported to the extent the data supports them, without claims of certainty. Where needed, the report can be prepared as an independent expert opinion for submission in proceedings; the court decides on its evidential weight.
Requests for covert monitoring of employees, unauthorised access to their personal devices, password cracking or lock bypassing are not accepted. Examined data is kept confidential, handed over when the work is complete and then deleted.
What I offer
Aligned with legal
Scope and authority defined in writing
Data protection
Examination limited to relevant data
Handover record
Who handed over the device, and when
SHA-256 and copy
Original data stored unaltered
Thorough trace analysis
App data, files and sync traces
Confidentiality
Data handed over and deleted after
Technologies I use
Example projects
A selection of live projects serving real users.
PDKS — Staff Attendance Tracking
Multi-tenant attendance SaaS in 4 languages.
ViewISG Virtual Warehouse Dispatch Assistant
Occupational safety ERP with REST API and BI dashboard.
View
MobilEksper — Phone Inspection & Repair Shop Software
AI-assisted device inspection, IMEI and parts checks, repair service and inventory management.
ViewHow we work
Free intro call
We clarify needs, existing systems and goals together.
Quote & roadmap
Scope, technology, timeline and budget within 24 hours.
Staged development
Weekly demos and a live test environment.
Launch & support
Go-live, training and ongoing maintenance.
Free pre-analysisThe first meeting and roadmap are completely free, with no obligation.
Staged delivery and approvalYou review each module on a test environment before we move on.
Written scope and rightsScope, delivery and source code rights are defined in the contract.
Frequently asked questions
Can a company examine an employee's company phone?
On devices owned by the company and issued for work, a purpose-limited examination in line with data protection principles is possible, provided there is a written device policy and the employee was informed in advance. The legal assessment should be made by your company's lawyer.
Can an employee's personal phone be examined?
Not without the employee's explicit consent or a decision by a competent authority. Requests for covert access to personal devices or lock bypassing are not accepted.
Can it be determined whether a departing employee took company data?
Traces of file access, external transfers and cloud sync on company devices can be examined. Whether traces are found depends on the device and on what was done afterwards; no result can be guaranteed.
What should be done with the device before the examination?
Take the device out of use; do not switch it off, reset it, update it or install new apps. Record the handover date and person in a written handover record.
Can an internal investigation report be used in court?
The report can be prepared as an independent expert opinion and submitted in proceedings. The court decides on its evidential weight and lawfulness.
Can deleted files on a company computer be recovered?
It depends on the disk type, encryption and usage after deletion. On SSDs and encrypted disks recovery is often limited; backups and cloud records are examined as well.