It’s pretty common practice to capture system images from returned employee equipment when they’re fired for cause (at least in the US). But it’s also pretty common for technicians to be forbidden from browsing those files without a very good reason.