These are all good ideas but remember to do this legally. Depending on the state that you’re in I would recommend that you have clear cut policies and procedures that state you are allowed to do this. If not push for having legal make them. This could be a mine field your stepping into and or you could really screw somebody’s life over. But if done right you couuld be the new Forensic analyst and show the comapny how valuable you are.
We are a large enterprise - I'll tell you a dirty secrect. Everybody has porn on there computer - because of caches. If an over zealous HR manager got a hold of that evidence that I supplied as a security expert they have a duty to interrupt it. And people could lose there livelihoods or lives
This has happened a lot more than you think or realize. Your manager could also have alternative motives that you are unaware of.
I don’t mean to discourage you – just make sure that you are aware of these issues and I would have a documented trail as a CYA for you ass. Stored off site that clearly states that you a right and a duty to do this. I would also review evidence handling guidlines, custody issues and reccomendations forecnsic pratices in case this blew up on you.
If these are not in place and it blew up in your companies face I would be that you my friend will be holding the bag. Especially since you have no training in this. Corporate Lawyers are the worse form of scum on the planet - they will not say your ass if this goes wrong.
My 2 cents,
Ole Bubba
