Our client called 6 months after an employee was fired.

Things had turned bad and they wanted a forensic analysis of the company computer that he used.

Unfortunately, someone else was assigned the computer for 6 months. It was simply not possible to unravel the mess that this caused. Lots of evidence was lost, some recovered items without dates couldn't be associated with the fired employee.

Whenever an employee is terminated a forensic image of his hard drive shoud be made. It will be especially valuable when the wrongful termination suit arrives 2 years later.