Insider data theft leaves no broken windows, making traditional forensics blind. But you can still detect it. How? Filesystems have typical patterns of access, which data theft disturbs. By analyzing these patterns, you can detect data theft months after its occurrence. You'll learn how to use this method, called stochastic forensics, to catch otherwise invisible data thieves.