Female Bank Employee Wrongfully Terminated Following Maternity Leave

Case Overview

This case involves a wrong termination dispute at a large bank. The employee in question was granted 12 weeks of maternity leave at the end of the calendar year. In her absence, the company hired someone to perform her job in the interim. The employee suffered a particularly difficult pregnancy due to her past medical history of severe arthritis. When the employee returned in the new year, she had limited mobility but was still able to perform her job at the same caliber she had before taking maternity leave. Within a week of her return, the employee was notified that her job description had changed while she was away. According to her supervisor, the job description included a specific physical and functional capacity which she could no longer perform. As a result, she was terminated from her position. The employee who took her place noted that the job description he received did not include information on any specific physical and functional aspects. It was alleged that the company changed the job description after the employee’s return to push her out. An expert in computer forensics was sought to conduct a forensic analysis on the company’s intranet to determine when the job description was changed.

Questions to the Technology expert and their responses

Please describe your experience performing forensic analysis of information manipulated via intranet.

I have reviewed many employment matters in which document metadata is at issue. If the job description was contained in a document, the document metadata would be an important piece of evidence because it may contain file creation, access and modification dates and times. If the description was only on web-based medium and only accessed online through the intranet, it would have to be proved or disproved that someone accessed the job description and altered it at some point. For this, logs would be required showing who accessed the area of the intranet containing the job description during the time frame in question. Intranet systems range in architecture, design, and functionality. I would need more specific information about how the description was composed, stored, and accessed to determine when the job description was changed.

About the expert

This expert has over 20 years of experience in law enforcement, specializing in electronically-facilitated criminal investigations and digital forensics. He holds a BS in Criminal Justice from Virginia Commonwealth University and has completed supplemental training courses with the Internet Crimes Against Children Task Force, the Department of Homeland Security, the Secret Service, Guidance Software, Katana Forensics, and the High Technology Crime Investigation Association. He is a certified cellebrite corporate investigator, cellebrite certified operator, cybercrime examiner, and advanced smartphone analyst. He formerly served as an officer with the Virginia Commonwealth University Police Department, as a patrol deputy for the Louisa County Sheriff's Office, as a detective in digital forensics for the Louisa Country Sheriff's Office, and as a sergeant for the Thomas Nelson Community College Police Department. Currently, he serves as an adjunct Instructor for a law enforcement training academy in Virginia and at a rapid response training facility at a university in Texas. He also works as the director of digital forensics and eDiscovery at a legal company, as an adjunct professor at a university in Virginia, and as the founder and principal consultant for a private digital forensics firm.

E-020691

Specialties:

Technology