There is a laptop hard drive and a desktop computer to be examined. The laptop hard drive belongs to the HR manager Gunrerk, Phatpong
The PC belongs to Sarnsern, Piyapong who works under the HR manager.
There is the possibility that the HR manager has tried to delete key information from the hard drives. I am trying to find out the date when the laptop was taken away from the HR manager. We need to examine the drive and look at what activity took place immediately before this date. This includes identifying anything deleted, what programs were run at this time such as cleaning programs and look at unallocated space to see if there is any indication that wiping programs have been used. What USB devices have been connected and the date of connection.