When an employee leaves the company, one of the first actions taken by the IT team is formatting the laptop.

It seems logical. The device needs to be reassigned. The data needs to disappear.

The problem is that formatting does not erase what you think it erases.

What happens when you format a drive

When a file is deleted or a drive is formatted, the operating system removes the pointer to that file — not the file itself.

It is like tearing out the index of a book. The content is still there. You just no longer know where each chapter is located.

This means that a forensic investigation, performed before new data overwrites the drive, can recover a surprising amount of information.

What actually remains stored

Even after formatting, it is still possible to recover or trace:

• Deleted files — the content remains on the drive until it is overwritten. In most cases, it never was.
• Metadata — who created the file, when it was created, from which machine, and how many times it was opened.
• Access logs — which folders were opened, which files were accessed, and at what time.
• USB device records — every external device connected to the system is logged with date, time, and identifier.
• Windows Prefetch — a list of every program executed on the machine and when it was last used.

Each of these elements creates a timeline. And that timeline tells a story — whether you want it to or not.

The scenario companies keep repeating

Imagine an employee in the final days before termination. During the previous three days, they accessed contract folders outside their department. Copied files to an external hard drive. Returned the laptop already formatted.

They thought it was clean.

The forensic investigation was able to recover the complete list of accessed files, the exact time of each access, the identifier of the connected USB device, and the names of the copied files.

This is not fiction. This is what a standard forensic investigation can uncover — as long as it is performed before the drive is overwritten.

The biggest risk is not the incident

It is not knowing it happened.

Companies that format devices without prior forensic analysis lose the only time window in which evidence still exists. Without evidence, there is no investigation. Without investigation, there is no accountability. And the problem repeats itself.

How Ingite helps

With the Cloud Digital Forensics Investigation module, your company gains complete traceability of actions performed on corporate devices.

It becomes possible to discover what happened, when it happened, who did it, and how — with concrete evidence for audits, internal investigations, and critical decisions.

Before the next laptop gets formatted, it is worth asking:

“If there was a data breach, would I be able to prove it?“

See a practical example before continuing:

Click here to watch the full video

👉 Get started now and understand what is happening inside your environment.