Episode 2: The Insider

Date: Wednesday, May 27^th 
Time: 14:00 BST
Duration: 45 minutes (includes Q&A)

The investigation turns inward. The employee’s corporate devices are collected for forensic examination. They’re clean. No suspicious apps. No unusual transfers. The case nearly stalls.

Then someone remembers the security footage. The phone on the desk during those client meetings wasn’t the corporate phone. It was a personal device. And when forensic examiners get access to it, what they find is methodical, systematic, and far bigger than four victims.

The insider was not the mastermind. The insider was the supply chain. And what had already been done with the stolen identities changes everything.

You will walk away with:

• Why limiting forensic analysis to corporate devices can derail an insider threat investigation
• How mobile device extraction recovers recordings, images, and encrypted messaging data from personal devices
• Techniques for determining the full scope of an insider compromise through device timeline reconstruction