1. Background / Requests
Mr. X, a sales representative of a certain company, accidentally erased the data on the company PC.
The deleted data includes sales-related data, customer lists, and email data exchanged with customers.
In particular, I want to restore emails exchanged with customers.
Also, I would like to return the PC to work in the shortest possible time.

2. FRONTEO's proposals and work
Proposed "evidence preservation", "data restoration", and "data extraction (delivery)" of Mr. X's PC.
In addition, we promise to return the PC promptly after the evidence preservation is completed.

3. Survey results ・ After that
On the day of work, we received the PC in the morning and carried out evidence preservation.
After the work is completed, return the PC in the evening.
The restoration work was handled by multiple tools, and related documents and emails were successfully restored.

1. Background / Requests
It turned out that Mr. X, a retired former employee of company A, has changed jobs to competitor company B.
An in-house investigation revealed that "Mr. X had copied a large amount of trade secret data to a USB stick 2-3 days before his retirement date" in the log of the security audit tool.
Promptly consult with a lawyer and, in the presence of a judge, carry out the "evidence preservation petition trial" stipulated in Article 234 of the Code of Civil Procedure to preserve evidence of trade secret data existing at the homes of Company B and Mr. X. A plan to do was made.

2. FRONTEO's proposals and work
Company A, a law firm, and our company hold a meeting to hear about information that can be identified as trade secret data (file name, KW in the document, etc.), and make an efficient and comprehensive petition for evidence preservation. Conducted consulting for creating a list of verification items in the document.
Since there was a possibility of visiting multiple bases in one day for evidence preservation, we prepared for the day by "designing and developing a dedicated data crawling tool" in order to perform comprehensive data crawling in a short time.

3. Survey results ・ After that
Evidence preservation was carried out at two bases (the head office of Company B and the workplace where Mr. X works) with the judge.
Files (hundreds) that match the data listed in the catalog in advance are acquired from the internal server of the head office, and related files and emails (thousands) are sent from the PC and USB memory used by X. Evidence was preserved and submitted to the court.
After that, it developed into an unfair competition prevention law case.

1. Background / Requests
There was whistle-blowing information that Mr. X, an employee who will retire soon, "has taken out trade secret information", and it became necessary to investigate Mr. X's company PC and company mobile phone (smartphone).

2. FRONTEO's proposals and work
Proposed a survey of the holding status of trade secrets in Mr. X's company PC and smartphone and a survey of external outflow routes.

3. Survey results ・ After that
From the PC, it was confirmed that Mr. X had trade secret information outside the scope of his business, and that the connection of a USB memory that was not registered in-house was also confirmed.
In addition, a folder of online storage client tools was found in the restored data, and we confirmed the situation where multiple data may have been leaked.
Furthermore, it was confirmed from the message app on the smartphone that the company members were exchanging information to confirm the storage location of trade secret information.
Based on the results of this survey, a lawyer conducted a hearing with the person himself and allowed him to take out the information, so FRONTEO responded to the complete deletion of related information to prevent information leakage.

1. Background / Requests
It was pointed out that Mr. X, the manager of the marketing department of company A, was doing something flashy, and company B, which the department requested to produce promotional materials, contacted the legal department of the company.
When I inquired Company B about the amount billed and paid for promotional materials in an in-house investigation, it was discovered that there was a discrepancy.

2. FRONTEO's proposals and work
Considering that it is necessary to investigate the exchanges related to the transactions between company A and company B, it is decided to extract emails from the mail archiver in company A and investigate the exchange of money without being detected by Mr. X. Suggestion.
We conducted a survey of Mr. X's email using a self-developed document review tool (Lit i View).

3. Survey results ・ After that
Using the artificial intelligence (KIBIT) of Lit i View, we conducted an efficient investigation and confirmed the existence of Mr. Y, who is kicking back.
"Argon" was used in the kickback exchange between Mr. X and Mr. Y.
We also conducted a person correlation survey using the recipient and sender of the email, and confirmed two people who were suspected to be accomplices.
After that, Company A and corporate lawyers heard about the facts, and the parties concerned, including Mr. X, were charged with criminal charges.

1. Background / Requests
Company A employee X became ill while working and was taken to a hospital and died a few weeks later.
Since Mr. X's family had heard before Mr. X's life that he was staying at work because he was too busy to go home, he thought that there was overwork due to work in the causal relationship with Mr. X's death. He filed a complaint with the Labor Standards Inspection Office through a lawyer.
Based on the allegation, Company A conducted an internal investigation into Mr. X's working conditions, but could not confirm the working conditions that would lead to overwork.
In the wake of this situation, the Labor Standards Inspection Office decided to sort out the arguments of both parties by saying, "Electronic devices that record all the work and living conditions of Mr. X, including the PC used by Mr. X at work. FRONTEO decided to conduct an investigation because it requested Company A to "investigate and clarify the facts."

2. FRONTEO's proposals and work
Based on devices that record Mr. X's behavior (PC, smartphone, business application usage log remaining on the server, entry / exit record to work, car usage status, etc.), Mr. X's behavior survey is conducted in chronological order ( Proposed to make it into a timeline and submit it to both Company A and Mr. X's relatives.

3. Survey results ・ After that
A large number of logs recording Mr. X's actions were organized and submitted to both parties.
After that, based on the request from Company A, "Since the amount of data is too large, I would like to request a detailed analysis," Mr. X conducted a detailed behavioral analysis.
As a result, it was found that although logs were recorded in the middle of the night, most of them recorded access to hobbies and video sites, and there were no logs related to business.
After that, information such as Mr. X's testimony that "I was staying at work on weekdays because my home is far away" was confirmed in the testimony of the employee of company A was added, and the industrial accident certification etc. was postponed. ..
In addition, FRONTEO provided an explanation to the inspector because the Labor Standards Inspection Office requested an explanation of the analysis method.

1. Background / Requests
Company A received a message from its business partner, Company B, that "a suspicious e-mail claiming to be Company A has arrived."
When company A conducted an in-house investigation, a virus was detected from a terminal dedicated to the business management system.
Customer information is stored in the terminal, and it became necessary to promptly confirm whether or not personal information was leaked.

2. FRONTEO's proposals and work
We proposed and started the investigation of the trace of the virus remaining in the terminal dedicated to the business management system and the investigation of the network log.

3. Survey results ・ After that
Multiple viruses were confirmed from the email data remaining in the business management system dedicated terminal.
After investigating the behavior of the virus, it was found that the OS settings were changed and the terminal-specific information and stored e-mail address information were sent to an external site.
Based on the survey results, Company A carried out "Caution and apology for suspicious e-mails" to the e-mail address stored in the terminal, and explained the circumstances and the extent of damage to the concerned parties.
In addition, corrective action was taken for the fact that anti-virus measures were not taken only for specific segments, and FRONTEO conducted incident response training for employees of Company A to prevent recurrence.