Oracle Investigations Group was contacted by a Sacramento area school that had recently terminated a business manager. The employee had deleted necessary business documents from the school’s server and computers prior to termination and had also taken a laptop computer. The laptop computer was returned by the employee only after local law enforcement became involved but the school still believed that the terminated employee was in possession of a missing external hard drive belonging to the school which contained numerous school documents. Our computer forensics expert was able to determine that the laptop forcibly turned in by the terminated employee had accessed the missing external hard drive after the employee had been terminated, proving that the hard drive was in the possession of the former employee. The investigation was turned over to local law enforcement for follow up and criminal filing.