CHECKLIST
While conducting a corporate internal investigation, or preparing discovery requests, the following could be locations of relevant evidence:
Identify and preserve
[ ] Company network file and print servers
[ ] Company network file and print server backups
[ ] Company email servers
[ ] Company email server backups
[ ] Company PC/Laptop
[ ] Company PC/Laptop backups
[ ] Floppy diskettes, CD, tape, Zip or Jaz disks found in and around the workspaces of the each subject
[ ] Personal PC/Laptops used by subjects at their home to conduct company business
[ ] Personal Internet email accounts
[ ] Voice mail machine backups

Compile
[ ] Office telephone records sorted by date
[ ] Calling Card records of each individual sorted by date
[ ] Cell phone records of each subject sorted by date
[ ] Fax machine logs near each subject sorted by date
[ ] Network access logs sorted by date
[ ] Company expense reports and credit card bills sorted by date

Diagram of Possible Digital Evidence Locations