An oil company's senior management has reason to suspect that John Smith, one of the company's mechanical engineers allegedly took information that was clearly identified as proprietary. The company's legal office has requested digital evidence regarding the potential violation of company policy, which prohibits the sharing of proprietary information without prior approval. The employee was not authorized to access proprietary information. All employees sign nondisclosure agreements (NDAs) and acceptable use policies (AUPs). Senior management and the legal office have approved this request. You are a member of the investigative team that has been asked to develop an investigative plan of action.

1. Discuss the strategy that your team will use toboth maximize the collection of evidence and minimize the impact on the organization.

2. Describe the tools and techniques your team will use in evidence gathering, preparation, and analysis.