Ontario Private Investigator Practice Exam

How should evidence be protected if an employee is found misusing a company computer?

1. By deleting the data

2. Isolate the unit and prevent further use

3. By making copies of all files

4. Notify the employee immediately

The correct answer is: Isolate the unit and prevent further use

When an employee is found misusing a company computer, the first step should be to isolate the unit and prevent further use. This helps to limit any potential damage that the employee may cause and prevents them from accessing any confidential information. Deleting the data may result in the loss of important evidence and making copies of all files may be time-consuming and not necessary. Notifying the employee immediately may also not be the best option as it could give them time to cover their tracks. Therefore, the best course of action is to isolate the unit and prevent further use until an investigation can be conducted.