Problem Statement
An employee is suspected of data exfiltration. What is the best forensic approach?
Explanation
Evidence must be preserved before any confrontation.
Collect workstation logs, emails, and external device records to build a timeline and confirm data transfer activity.