Employment & HR
Digital forensics for employment matters and HR investigations.
When a workplace matter turns on what someone did with company devices, accounts, or data, we provide the forensic evidence the file needs.
Typical matters
Where we are most often retained.
- Workplace harassment investigations
- Departing-employee data theft
- Termination-for-cause evidence support
- Wrongful dismissal defence
- Policy violation reviews
- BC Human Rights Tribunal matters
Engagements we run
What this work looks like in practice.
- Departing-employee investigations where data exfiltration is suspected.
- Workplace harassment investigations with messaging, email, and device evidence.
- Policy violation matters involving misuse of company resources, time theft, or unauthorized data access.
- Wrongful dismissal matters where the company needs forensic evidence to defend its position, or the dismissed employee needs an independent review.
- Workplace investigations under BC PIPA and PIPEDA where the boundary between employer access and employee privacy is at stake.
What clients tell us matters most
Priorities we hear from this industry.
A defensible record for the file. A finding that survives a wrongful dismissal claim, a labour board complaint, or a privacy complaint. We write to that standard.
Privacy law literacy. PIPEDA and BC PIPA constrain employer access to employee personal information. We work within those constraints and document compliance.
Plain-English reports for HR. HR is not an IT team. The report has to make the relevant facts clear without forcing a forensics tutorial.
Speed and discretion. Employment matters often need to move fast and quietly. Termination decisions, severance negotiations, and labour-board response timelines all create urgency.
Services we provide for employment & hr
Most-engaged forensic services.
Computer Forensics
Forensic imaging and analysis of Windows, macOS, and Linux systems for litigation, internal investigations, and expert witness work.
Learn moreMobile Forensics
iOS and Android extraction including chip-off, JTAG, and ISP techniques for damaged or locked devices that conventional tools cannot read.
Learn moreCloud Forensics
Defensible collection and analysis of Microsoft 365, Google Workspace, AWS, Slack, Teams, and Salesforce evidence under legal hold.
Learn moreCommon questions
Employment & HR questions we hear most.
Can an employer legally search a work laptop in BC?
Generally yes, with appropriate notice and a reasonable workplace purpose, under BC PIPA and PIPEDA. The employer's right is strongest on company-issued devices used for company purposes, and weaker on BYOD devices that contain personal information. Specific facts matter.
What about a personal phone used for work?
BYOD devices are a different analysis. The employee retains a privacy interest in personal content even on a device used for work. Forensic access is usually limited to work-related apps and accounts, with the personal partition off-limits. We design BYOD engagements to fit that constraint.
Can we use forensic findings in a wrongful dismissal defence?
Yes, when the findings are obtained through a defensible process and produced through proper disclosure. The forensic record often strengthens the employer's position by documenting the exact misconduct that supported the dismissal decision.
How quickly can you preserve evidence for a termination?
Endpoint and cloud preservation can usually start within the same business day. The most time-sensitive piece is M365 or Google Workspace audit log preservation, where the default retention is 90 to 180 days and the clock is already running.
Can you support a workplace investigation that might never go to court?
Yes. Many employment matters resolve through discipline, mediation, or settlement rather than litigation. The forensic record still has to be defensible, because either side may later escalate. We treat every engagement to litigation-grade standards regardless of the expected resolution path.
Related industries
Other sectors we serve.
Corporate Internal Investigations
Defensible internal investigations: fraud, IP theft, departing employees, and policy violations.
ExploreLaw Firms
Court-tested forensic support for litigation counsel: acquisition, examination, and expert witness work.
ExploreInsurance
Cyber claims, claims fraud investigation, and subrogation support for Canadian insurers.
ExploreHave an employment matter that needs forensic evidence?
Tell us about the situation and the timeline. Our team will reach out as soon as possible.