How to Detect a Departing Employee Copying Sensitive Files to USB or Personal Accounts
Catch departing employees copying files to USB drives or personal accounts. See the signals that matter, what your logs still hold, and what to set up first.
Key Takeaways:
- To catch a departing employee copying files, feed the resignation date into your monitoring and watch for sensitive data moving to USB drives, personal email, personal cloud storage, or a personal AI account.
- A single copy doesn't prove much. Look for sequences: a bulk download, files renamed or zipped, then a first-time destination.
- Email logs won't rebuild 90 days. Google Workspace keeps email log search for 30 days, so the timeline has to come from every other source that still holds history.
- ORION Security reports first detections within 30 minutes of deployment and connects the download, the rename, and the upload into one sequence with classification and identity context.
To catch a departing employee copying sensitive files, connect the resignation date to your monitoring and watch for files moving to USB drives, personal email, personal cloud storage, or a personal AI account, judged against that person's normal work.
Customer lists, pricing models, and source code are meant to stay behind. Much of what leaves with people isn't malicious: they take "their" work without thinking it through. The rare deliberate theft is the expensive tail, and both look the same in the logs until you've read them in context. Here's how to catch the copy before it leaves, what you can still rebuild after a resignation, and what to put in place before a restructure.
Where the Copies Go: USB, Personal Email, Cloud Storage, and AI Accounts
The four destinations to watch are removable media, personal email, personal cloud storage, and personal AI accounts. Each needs a control that sees the device or the browser session, because the corporate tenant's own logs stop where the file leaves it. A single copy doesn't prove much; a sequence usually does.
USB and Removable Media
Endpoint data loss prevention (DLP) and device control record when a removable drive connects, which device it was, and which files were written to it. This is path T1, Wired Upload to External Storage, in our Data Loss Threat Model. MITRE ATT&CK tracks it as Exfiltration over USB (T1052.001). The useful signals are a drive the device has never seen, a large or unusual write, and sensitive files in that write. Block or warn on writes of restricted data where your policy requires it, and keep the device ID so the drive can be recovered.
Personal Email and Cloud Storage
Webmail and personal cloud uploads leave the corporate tenant entirely, so your email gateway and SaaS audit logs won't see them. A browser extension or endpoint sensor can: it records the upload to a personal Gmail, Dropbox, or Google Drive account and what the file contained. Watch for forwarding rules to personal addresses and sync apps that appear in the last weeks of employment.
Personal AI Accounts
A departing engineer doesn't need a USB drive to take source code. Pasting it into a personal AI account moves it just as far, and network logs can't tell that session from your corporate one, so you'll need a control in the browser or on the device. Our DLP for ChatGPT guide covers how AI tools are monitored in the browser and on the endpoint.
Why the Notice Period Is the Window That Matters
The data usually moves before anyone in security hears about the resignation. The HR system knows first, so the most useful control is a feed from HR to security that puts a departing employee's data movement under closer review from the day notice is given, with HR and legal agreeing the scope.
Resignations and layoffs don't carry the same risk. A person who resigns controls the timing and may have been collecting files for weeks; a person told about a layoff has minutes, unless access stays open after notice. Treat both as triggers, and agree in advance who sees the findings, what counts as normal handover activity, and when HR or legal steps in.
The Signals That Separate a Departure Copy From Normal Work
Look for combinations, not single events: a bulk download from a system the person doesn't normally use, files renamed or zipped before upload, a first-time destination such as a new USB drive or personal account, and activity outside normal hours or role. Each looks ordinary alone. Together they describe data leaving.
| Signal | Ordinary on its own | Risky in combination with |
|---|---|---|
| Bulk download from a CRM or repository | Quarter-end reporting, a migration | Notice given, plus a new destination |
| Files renamed or compressed | Tidying a project folder | A personal upload or USB write minutes later |
| First-time destination | A new approved vendor portal | Restricted data in the transfer |
| Access outside the person's role | Covering for a colleague | No ticket or request, in the notice period |
| Off-hours activity | A different time zone, a deadline | Volume well above the person's baseline |
Single-event rules either fire on everyone or miss the staged copy. That's why the sequence is the signal. Our guides to insider threat indicators and data exfiltration techniques cover the wider set.
Rebuilding 90 Days of Activity After a Resignation
Email logs won't get you there. Google Workspace keeps email log search for 30 days, while Drive log events last six months and Microsoft 365 audit records run 180 days to a year depending on license. Rebuild the timeline from every source that still holds history, and preserve it before the account is cleaned up.
Where the History Still Lives
| Source | What it shows | Default history |
|---|---|---|
| Google Workspace email log search | Messages sent and received, recipients | 30 days |
| Google Workspace Drive and Gmail log events | File views, downloads, shares; mail events | 6 months |
| Microsoft Purview Audit (Standard) | SharePoint, OneDrive, Exchange, and Entra activity | 180 days |
| Microsoft Purview Audit (Premium) | Same workloads, longer default for core services | 1 year |
| Endpoint DLP and endpoint detection | USB writes, file copies, archives, uploads from the device | Set by your platform's retention |
| Identity provider | Sign-ins, devices, locations, new app consents | Set by your plan |
Sources: Google Workspace data retention and Microsoft Purview audit log retention. Microsoft retention policies can extend audit records up to 10 years with the right license.
Build the timeline one event per line: who, when, which device, which source, which file, what happened, and where it went. Gaps in that line are where copies hide.
Preserve Before You Deprovision
Disable access, but don't delete the account. Deleting a mailbox or reimaging a laptop can erase the evidence you need, so put a hold on mail and files, image the device, and export the logs that will age out first. One ORION Security customer met this exact problem: its legal team needed a departing employee's activity after the 30-day email log window had passed, and the history it used came from ORION Security.
What to Have in Place Before Notifications Go Out
Before a restructure is announced, map every system each affected person can reach, pre-stage access removal for the moment of notice, rotate shared secrets and tokens, put source repositories and customer data stores under closer watch, and preserve logs instead of deleting accounts.
- Map access per person. Directory groups, SaaS apps, code repositories, customer databases, shared drives, and admin roles, including accounts outside single sign-on.
- Pre-stage removal. Prepare the disable actions so access ends at the moment of notice, not hours later.
- Rotate what's shared. Service account passwords, API keys, and deploy tokens the person could reach.
- Revoke app grants. Remove OAuth consents and personal devices registered to corporate accounts.
- Watch the crown jewels. Raise review on repositories, CRM exports, and finance data for affected teams from the planning stage onward.
- Preserve, don't purge. Place holds and export logs before deprovisioning.
- Agree the escalation path. Security, HR, and legal decide in advance who acts on a finding and how.
Our guide to building an insider threat program covers the standing version of this plan.
How ORION Security Reads Departing-Employee Data Movement
ORION Security doesn't predict who'll resign. It flags the point where sensitive data starts moving differently for a person, role, and destination, and it connects the download, the rename, and the upload into one sequence with classification and identity context, so the team can warn or block on supported channels before the file is gone.
The platform watches through API connectors to SaaS apps, a browser extension, and endpoint sensors for Windows and macOS, which cover USB drives and printers. It classifies what moved as it moves, then judges each step with the person's identity, the device, and the destination's trust. A customer export pulled from Salesforce, zipped on a laptop, and uploaded to a personal cloud account reads as one story, not three unrelated alerts.
When HR flags a departure, security teams can put that person under closer review where they've configured it. The same reading works before anyone knows a person is leaving: an employee who suddenly downloads customer files in bulk, opens folders they rarely touch, and zips documents for a personal destination shows up as movement that no longer fits their work. Each finding shows what moved, where it came from, where it went, and why it was flagged, and the connected history built from the deployed sensors and integrations is there when legal asks what happened. Our guide to insider threats explains why most of this exposure is accidental.
Interested in ORION Security? Learn more.
Frequently Asked Questions
Can you see what files an employee copied to a USB drive?
Yes, if an endpoint DLP or device-control agent was running when the copy happened, and you can't add one afterward. It records the device, the files, and the time. Without one, a forensic image of the laptop can sometimes show which drives were connected, but rarely the full file list.
How far back can you see file activity in Microsoft 365 or Google Workspace?
By default, Microsoft Purview keeps audit records for 180 days, or a year for core services under Audit (Premium). Google Workspace keeps Drive and Gmail log events for six months and email log search for 30 days. Export what you need before it ages out.
Should you lock a departing employee's account the day they resign?
That depends on the role and the notice period. Many companies keep access through a handover and raise review instead. For high-risk roles, or after a layoff notice, removing access at the moment of notice is safer. Disable rather than delete either way.
Is it legal to monitor employees who are leaving?
Rules differ by country and state, and many require notice to employees. Agree the scope with HR and legal, apply it the same way to every departure, and document it in your acceptable use policy before you need it.
What data do departing employees take most often?
Customer and prospect lists, pricing and financial files, source code, and internal documents such as contracts and strategy decks come up most in investigations. Those are the stores to watch first in any notice period.
Does DLP stop data theft during layoffs?
It helps when it's in place before notifications go out, and it won't do the whole job. DLP can warn or block risky transfers of restricted data on the channels it covers, but access removal, secret rotation, and log preservation still have to run on notification day.
