Insider Data Theft and Email Exfiltration Investigation

Hard GIAC GCIH cybersecurity drill: You are a GCIH-certified incident handler at a law firm investigating a departing employee's suspected data theft