Investigating People: IP Theft, Insider Fraud and Cyberstalking
Where you are: Part V — Forensics in Practice: Scenarios, Software and Business Cases · Lesson 5.2 · This lesson follows Chapter 9 (scenarios 2, intellectual property theft; 3, insider fraud; and 4, cyberstalking and harassment) of Dr. Al-Doori's IT Forensics Essentials.
Ethical scope: investigations that focus on a person carry the greatest risk to privacy and safety. They are carried out only with proper legal authority and, in workplaces, within the employer's lawful policies. Only examine devices, accounts and systems you own or are explicitly authorized to work with.
What you'll be able to do
By the end of this lesson you will be able to plan investigations in which the suspect, or the victim, is a person, lawfully and fairly.
- Plan the forensic actions for intellectual property (IP) theft, insider fraud and cyberstalking.
- Choose the right evidence sources for each, from USB records to database logs to message headers.
- Apply privacy, proportionality and victim-safety safeguards.
Scenario: Intellectual Property Theft
The situation. An employee is suspected of stealing proprietary data, such as trade secrets, source code or customer databases, and selling it to a competitor or using it for personal gain.
The actions the book lists:
- Forensic imaging of the employee's workstation, laptop and any personal devices involved, such as USB drives and external hard drives.
- File system analysis: file access history, document metadata and file transfers, to see whether sensitive data was copied or moved.
- Email and communication forensics: email accounts, communication logs and file-sharing platforms, for contact with third parties.
- Data recovery of deleted files and folders, and of encrypted data, that could show the theft.
The outcome. Evidence linking the employee to the theft, such as copies of proprietary files or emails discussing the transfer. The Part II and III skills come together here: USB connection records (Lesson 2.5), timestamps (Lesson 3.6) and hash searches for renamed files (Lesson 2.1).
Scenario: Insider Fraud
The situation. A financial institution suspects an employee of manipulating records or committing fraud: altering transactions, deleting records or acting without authorization in company systems.
The actions the book lists:
- Log analysis of system and application logs, tracking user activity: sign-in times, actions on records and changes to financial databases.
- Data recovery of deleted or hidden records, including examining backups for discrepancies. Comparing a backup with the live database can reveal exactly what was changed.
- Database forensics to find signs of manipulation, such as fraudulent transactions or altered critical records.
- Email and instant-messaging review for evidence of fraud or collusion.
The outcome. Altered records, unauthorized transactions or messages discussing the fraud, usable in legal proceedings or internal action.
Scenario: Cyberstalking and Harassment
The situation. A victim reports persistent threats and abusive messages through social media, email or messaging apps.
The actions the book lists:
- Social media forensics, including identifying the IP addresses used to send threatening messages or posts.
- Email and messaging investigation: headers and message logs, to trace where messages came from.
- Device forensics on the victim's own devices, looking for tracking software or malicious communications.
- Geolocation data from emails or posts that may show where the harasser was.
The outcome. Identifying the perpetrator through IP addresses, device identifiers or location data, with evidence that supports protective orders and accountability.
Safeguards: Privacy, Proportionality and Safety
Person-centered cases need extra care.
- Authority and ownership. An employer can usually examine its own systems under its policies, but a personal phone needs the owner's consent or a court order (Lesson 3.3). Regulators expect workplace monitoring to be lawful and proportionate; the UK Information Commissioner's Office, for example, publishes detailed guidance on monitoring workers.
- Proportionality. Look for what the authority covers, not for everything about a person's life (Part IV checkpoint, Scenario 3).
- Victim safety. In stalking cases, the victim's device may hold stalkerware, hidden monitoring apps installed by an abuser. The Coalition Against Stalkerware, founded with the Electronic Frontier Foundation and security companies, warns that removing such an app can alert the abuser and may destroy evidence. It advises contacting victim support services or law enforcement first, so that safety planning and evidence preservation come before removal.
- Attribution. An IP address identifies a connection at a moment in time, not a person. Linking it to someone needs further evidence, such as records from the provider obtained through legal process and corroboration from devices.
Real-World Example
Imagine (a fictional scenario) a credit union where a member complains that small fees keep appearing on her account. Internal audit finds 312 adjustments of between 3 and 9 dollars across many accounts over a year, each moved to an internal suspense account and then out to an external account.
With authority from the board, the examiner works through the book's actions. Log analysis shows every adjustment was made under one teller's user ID, nearly always between 18:00 and 18:30. Database forensics shows the adjustments were deleted from the daily report table but remain in the transaction journal. Backups from the previous year show the suspense account's balance growing month by month. The badge system, however, shows the teller left the building by 17:45 on many of those days. That points to her credentials being used by someone else. Email review then finds a colleague asking her for her password "to cover a shift". The careful timeline kept the investigation from accusing the wrong person.
From the Book to 2026
What the book teaches. IP theft, insider fraud and cyberstalking investigations combine imaging, file system and log analysis, communications forensics, data recovery and geolocation, with outcomes used in legal action and protection orders.
Why it made sense. These remain the right actions, and the scenarios are as common as ever.
What has changed. The evidence has spread out. Company data is often taken through personal cloud storage and messaging apps rather than USB sticks, so cloud audit logs and file-sharing records are now central. Workplace privacy rules have tightened, with regulators expecting monitoring to be transparent and proportionate. And awareness of stalkerware has grown: support organizations now publish guidance for victims, and the coalition's advice that removal can alert the abuser changes how and when a victim's device should be examined.
What to do now. Map every place the data could have gone (USB, cloud, email, messaging) before you start. Confirm authority for each source, especially personal devices. In harassment cases, put the victim's safety first and coordinate with support services before any change to their device.
What Would You Do?
A victim of harassment asks you to "just delete the spy app" you found on her phone so that she can feel safe tonight. What do you advise? Decide, then compare with the model answer in the note below.
Knowledge Check
In an insider fraud case, what can comparing a backup with the live database reveal?
Why does an IP address alone not identify a cyberstalker?
An employer suspects IP theft. Which device needs the employee's consent or a court order before examination?
Answers explained
- Question 1: b. Differences between a backup and the live data show what changed. That is exactly what the book's data-recovery action looks for.
- Question 2: d. Connections are shared and change over time. Linking one to a person needs provider records obtained through legal process, plus corroboration.
- Question 3: d. The personal phone is not the employer's property. Company systems (a, b, c) can generally be examined under the employer's policies and the law.
On "What Would You Do?": Advise her not to delete it yet. Removing the app could alert the abuser, possibly escalating the danger, and could destroy evidence. Help her contact a victim support organization or the police so that a safety plan is in place, and so that the app and its data can be documented as evidence first. In the meantime she might use a different, trusted device for sensitive communication.
Key Takeaways
- IP theft: image devices (including USB drives), analyze file access and transfers, review communications, and recover deleted data.
- Insider fraud: analyze logs and databases, compare backups with live data, and review messages for collusion.
- Cyberstalking: social media, email headers, the victim's device (stalkerware) and geolocation, with victim safety first.
- Confirm authority for every source, stay proportionate, and remember that an IP address is a connection, not a person.
Sources
- Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 9 (scenarios 2, 3 and 4)
- UK Information Commissioner's Office — Employment practices and data protection: monitoring workers
- Coalition Against Stalkerware
- Electronic Frontier Foundation — EFF, antivirus companies and human rights groups launch Coalition Against Stalkerware (2019)
- NIST — IR 8006: NIST Cloud Computing Forensic Science Challenges