One of your key employees left a few months ago. He's now working for your hottest competitor and soliciting all of his old accounts. And he knows your profit margins. Your first impulse is to fire up his old laptop and go digging for proof that he stole your customer list. Good instincts—the contents of that laptop will probably be "Exhibit A" in your lawsuit nailing the defector the wall.
Don't touch that computer. Stop, breathe and hire an IT forensic professional. If not, you'll regret it.
Chances are, you'll need a forensic analysis done on the laptop because most folks are careful to double delete the proof of their data theft. IT forensics can often show what your ex-employee took and how far he went to cover it up.
Courts can be nit-picky when it comes to IT forensic evidence. The starting point for any forensic analysis is a clean forensic image of the drive. The more you use a drive, the more you dirty the forensic trail needed to get your analysis into court. A forensic image usually costs about $400.
One company learned that lesson the hard way. In Koo, the president took his ex-employee's laptop home for two days. He admitted that he made some screen shots and "could have" moved some files. An Oregon federal court kicked out some of the forensic analysis that was later done on the computer. The court couldn't get past the fact that the computer had been used extensively before forensic IT got involved.
In fact, many companies make a forensic image of key employees' computers when they leave. These companies know that IT forensic evidence can break a case wide open. It keeps your ex-employees honest.