Workplace disputes that reach litigation almost always involve digital evidence. The communications between the parties — messages, emails, internal system logs, and the documents attached to them — tell the story of what actually happened, when it happened, and who knew. The question is whether the evidence was preserved and whether the examiner retained to analyze it knows how to find what matters.
Cyber Agents, Inc. has worked sexual harassment, wrongful termination, workplace misconduct, and employment fraud matters in Kentucky, Ohio, Maryland, and other states. The digital record in these cases frequently contains evidence that the discovered documents do not reflect — deleted communications, metadata that contradicts claimed dates, and platform activity that establishes a timeline the parties dispute.
Sexual harassment
In sexual harassment matters, the communications are the evidence. Text messages, messaging application exchanges, email, and social media direct messages between the parties often contain the clearest record of what was said and when. The question is whether the record produced in discovery is the complete record.
Device extraction recovers communications that were deleted after the incident. Like a deleted file — gone to the user, still there to anyone who knows where to look — the messages the producing party believed were gone are often fully recoverable from the device’s database. An extraction may also recover metadata indicating when messages were sent, read, or deleted. The available fields and resistance to undetected alteration depend on the application, device, extraction method, and retained artifacts.
We have examined devices in sexual harassment matters where one party had deleted messages they did not intend to produce. The deleted communications were recovered from the device’s database. The gap between what was produced and what existed was visible in the underlying data.
In cases where the harassment occurred over workplace communication platforms — Teams, Slack, Outlook — the platform’s own retention and logging systems provide an independent record that does not depend on what the parties chose to preserve or produce. We analyze platform export data, server logs, and message database archives to establish what was communicated through official channels.
Wrongful termination
The digital record around a termination decision frequently includes evidence of the actual basis for the decision — as distinct from the stated basis. Internal email chains, document access logs, and messaging activity in the period before a termination reflect what was being discussed, by whom, and when.
If a termination is claimed to be performance-based and the communications record shows something different — that the decision predated the performance issue, that a protected characteristic was discussed internally in relation to the employee, or that similarly situated employees were treated differently — that record is often recoverable from the employer’s systems.
We recover and analyze email metadata, document access and modification logs, file deletion activity, and internal communications from company devices and cloud-stored platforms. We work with Microsoft 365, Google Workspace, SharePoint, Teams, and other enterprise platforms from which employers produce data in employment disputes.
Workplace misconduct and internal investigations
In matters that begin as internal investigations before litigation, digital forensics often determines what the investigation concludes. When an employee is accused of misconduct — theft of data, destruction of company records, access of systems without authorization, or fraudulent activity — the device and system record either supports or refutes the allegation.
We have examined company devices and cloud accounts in workplace misconduct matters, analyzing login records, file access logs, email activity, and application usage to reconstruct what a specific user did on a specific system during a specific time window. We have identified evidence of unauthorized access. We have also found that the evidence did not support the allegation, which is an equally important finding for the attorney whose client is falsely accused.
Unemployment fraud and wire fraud
Employment-related fraud matters — including unemployment fraud and wire fraud charges arising from workplace conduct — require the same forensic discipline as other digital evidence work. We have analyzed communication records, financial platform data, and device activity in employment fraud cases, providing both defense and prosecution support depending on the matter.
Document authentication in employment matters
Documents that surface in employment litigation are not always what they appear to be. Offer letters, non-compete agreements, performance improvement plans, and termination records that were created or modified after a dispute arose can often be identified through metadata analysis.
A document’s internal metadata records when it was created, by whom, using what software, and when it was last modified. When a document that a party is relying on in litigation does not match the metadata profile it should have for its claimed age or origin, that discrepancy is visible in the file and can be analyzed and explained to a court.
When the document was produced as a PDF, the available native file can be essential to a defensible forensic report.
We have authenticated employment documents and identified documents that were inconsistent with their claimed origin in contract and misconduct matters.
Case types we handle
- Sexual harassment claims requiring device extraction and communication recovery from phones, tablets, and workplace messaging platforms
- Wrongful termination matters requiring internal communications review, document metadata analysis, and access log examination
- Workplace misconduct investigations requiring device imaging, cloud account analysis, and timeline reconstruction
- Employment discrimination cases where internal communications establish the basis for an adverse employment action
- Non-compete and trade secret disputes requiring device and cloud account examination for evidence of data exfiltration
- Employment fraud matters including unemployment fraud and wire fraud charges arising from workplace conduct
Why it matters who does the analysis
Employment litigation involving digital evidence often comes down to a single forensic question: is the record the other side produced the complete record? An examiner who has worked these cases knows what to look for when the answer is no — which file formats preserve deletion timestamps, which platforms maintain server-side logs that survive device deletion, and how to read a metadata trail that an attorney without forensic training would not know to request.
Cyber Agents has testified and consulted in employment and workplace misconduct matters. We produce reports that document our methodology and findings, and we are available for deposition and trial testimony.
Related services and litigation support
Contact Cyber Agents to discuss digital forensic litigation support for your matter.