We have ended more employment disputes and proven an employees malicious intent, with recovered internet searches than any other form of evidence.

Each time a user searches Google, Bing, Yahoo or any other search engine, the exact words they entered are recorded, often permanently, by the computer.

Imagine seeing searches for "jobs at company x", "how to copy files from the computer without my boss knowing", "how to set up a company" and "how do I fake constructive dismissal" these would be an immediate red flag which would cast doubt on the trustworthiness of any employee.  Yes, people actually type these exact search words into Google!

Most, if not all people have personal E-Mail addresses, which they often access using a workplace computer.   Whilst this may not be a violation of company policy, sending company data to and from such E-Mail accounts most certainly is. 

There are also GDPR liabilities when such events take place - with heavy fines being issued by the Information Commissioner's Office. A DAC checks for the presence of any such accounts, allowing an employee to be questioned upon the usage of such accounts and any leaks of company data to these accounts identified.

It is rare to see a computer that has not had a USB storage device used in conjunction with it, such as a memory stick or portable hard disk drive.  One trait users have, is that they often open files on USB devices and work from them.  

These actions are recorded by the computer and are extracted as part of the DAC.  As with E-Mail accounts, the storage of company data upon them is an extremely high risk (if they are lost) and subject to falling foul of GDPR if personal information (that of customers as an example) is stored on them and the company is not aware of this.

A DAC can be used to audit which USB storage devices your employees have been using and identify leakage of intellectual property and unauthorised storage devices.

When a file or folder is opened by a user, this is recorded by the computer, often permanently.

A DAC collates all of these actions into a chronological list, which can be used to demonstrate which files and folders a user has accessed - and most importantly - when. 

It is common for dishonest or disgruntled employees to explore the contents of the company's computer system - for their own gain (by stealing useful files) or to access information that they are not permitted to - commonly pay scales, promotion and performance reports or other information that would aid the employee in some way. 

Using a DAC to audit what a user has been accessing can be a powerful weapon in any dispute or litigation process that may be underway.

Cloud storage has become incredibly popular and is fast becoming the defacto way in which employees ex filtrate (steal) your company's intellectual property. Plans, diagrams, customer lists, databases, artwork, program code - are all often found to have been illegally uploaded to a Cloud storage account by an employee.

A DAC detects usage of these services and where possible lists files which have been uploaded to them. A valuable tool in the fight against intellectual property theft.

Employees often become aware that their wrongdoing has been spotted - they swiftly delete material that could be used to incriminate them, be those documents or E-Mail messages.

A DAC provides you with a list of files that have been deleted from the computer, and with the "Premium" DAC a list of E-Mails that have been deleted.

This alone can be enough evidence to dismiss or end an employment dispute if malicious deletions have taken place in an attempt to hide their activities.

An employer provides a computer to an employee with a degree of trust.  A DAC can be used to audit an employee's usage of time - from determining how many times each day they have accessed social media (such as Facebook), through to seeing how many times they have launched the solitaire game built into Windows.

We often detect employees that are moonlighting and using their computer during work hours to carryout tasks for another employer.

It is also not uncommon to observe the use of "wiping" or "track clearing" software in an attempt to hide their activities.

All very powerful weapons to use in an employment dispute.

Employees are often seen to install programs onto their computer for personal usage, whilst this is often a violation of a computer AUP (Acceptable Use Policy often issued to employees at the commencement of their tenure) - it is often overlooked.

Such programs can range from those that are unlicenced (such as cracked games or pirated productivity programs) through to the malicious (such as programs contaminated with virus or trojan programs that allow external attackers to freely access the company's corporate network) - through to those classed as counter forensic.  All of which put the company at risk in one form of another.

Counter forensic software is being encountered increasingly in the DAC's we perform.  Programs such as CCleaner, Evidence Eliminator and various other "wiping" tools are being used by novice users in an attempt to hide their tracks.

Once again, the presence of any such programs is grounds for dismissal or reprimand, both useful tools in an employment dispute.

When a phone or computer is connected to a WIFI network, for example in a coffee shop, a home address - or even a competitors office, this information can be extremely useful.

It is possible to timeline locations that a computer/phone has been recorded at - sometimes even if the WIFI at the location was not connected to by the computer or phone.