Client
National professional services firm

Background
A matter relating to alleged theft of intellectual property.

Task
The client suspected that a former employee had stolen information and accessed confidential data including private contacts lists and financials when leaving the client’s company. PLT was instructed to find evidence supporting that claim.

Challenges
The identification of relevant activity that supported the client’s claim in the face of systematic and secure deletion of hard evidence; obtaining a court order to expand the investigation.

Overview
The team took the former employee’s company iPhone and laptop and imaged and interrogated them. Nothing was found on the iPhone as it had been reset, and the laptop had been wiped of relevant files, therefore there was no hard evidence to support the client’s claims.

However, a thorough interrogation of all aspects of the devices did uncover relevant, supporting evidence. Intellectual property in the form of Microsoft Word and Excel files, that included the client’s private contact list and financials, had been accessed on the morning of the former employee’s last day. The team was also able to identify intellectual property in the form of Microsoft Word and Excel files that were accessed by the former employee within three days of his/her last day and then kept in a folder on the suspect’s computer entitled “Take”.  There was also evidence of secure wiping, that utilities had been installed to destroy data and that mass storage and copying devices had been connected and registered with the former employee’s computer within their notice period.

Based on the evidence that PLT provided, the client was able to obtain a court order to seize the former employee’s home machines and machines from the new business venture the former employee had since started. These were then analysed to determine where the client’s information had been used, where it had been distributed and for what purpose.

Findings
Significant evidence was identified and explained that illustrated the actions of the individual in question.

Outcome
PLT presented its findings to the client in a report that was easily understandable and was then used to extract a very favourable compromise agreement with the suspect.