This would happen in internal investigations (the worst kind, it means you can;t rely on the company's protection), and ones where there's already a warrant for

This would happen in internal investigations (the worst kind, it means you can;t rely on the company's protection), and ones where there's already a warrant for the entire drive, meaning there's already strong evidence to justify this. You'll never see someone handing over the drive just for discovery. But if they have to provide something, executives are safe almost by default. Companies explicitly use data retention policies as an official means of destroying evidence on centralized systems (on the servers), and they're not shy when discussing this openly (just not in writing). Executives will not be happy about losing their email history so they store a copy elsewhere, on another workstation whose existence is simply not a matter of common knowledge, many times it's associated with a management assistant. Or they will use aliases [0] and investigators will never know there's anything relevant there. When cooperating with the authorities only the official device used by that person is presented, the one in the asset management. You can't ask for something unless you know and can prove it exists. These investigations could eventually cost a company billions so trust me, they invest billions worth in effort to make sure evidence stays buried. [0] https://www.reuters.com/article/us-usa-tillerson-climatechange-idUSKBN16L06J https://www.reuters.com/article/us-usa-tillerson-climatechan...