Case Study: Professional Services Firm Suspects Theft of IP
-min.avif)
A national professional services firm engaged us to find evidence of a former employee’s theft of intellectual property prior to separating from the organization.
Client Challenge
The client suspected that a former employee had stolen information and accessed confidential data, including private contact lists and financials, when leaving the client’s company. We were instructed to find evidence supporting that claim, which involved identifying relevant activity that supported the client’s claim in the face of systematic and secure deletion of hard evidence, as well as obtaining a court order to expand the investigation.
Consilio Response
The team took the former employee’s company cell phone and laptop and imaged and interrogated them. Nothing was found on the phone as it had been reset, and the laptop had been wiped of relevant files, therefore there was no hard evidence to support the client’s claims.
However, a thorough investigation of all aspects of the devices did uncover relevant, supporting evidence. Intellectual property in the form of data files, that included the client’s private contact list and financials, had been accessed on the morning of the former employee’s last day. The team was also able to identify intellectual property in the form of data files that were accessed by the former employee within three days of their last day and then kept in a folder on the suspect’s computer entitled “Take.” There was also evidence of secure wiping, that utilities had been installed to destroy data and that mass storage and copying devices had been connected and registered with the former employee’s computer within their notice period.
Based on the evidence that we provided, the client was able to obtain a court order to seize the former employee’s home computers and computers from the new business venture the former employee had since started. These were then analyzed to determine where the client’s information had been used, where it had been distributed and for what purpose.
Results Achieved
Our team identified and analyzed significant evidence to demonstrate the actions of the individual in question. We presented our findings to the client in a report that was easily understandable, which the client then used to negotiate a very favorable compromise agreement with the suspect.
A national professional services firm engaged us to find evidence of a former employee’s theft of intellectual property prior to separating from the organization.
Client Challenge
The client suspected that a former employee had stolen information and accessed confidential data, including private contact lists and financials, when leaving the client’s company. We were instructed to find evidence supporting that claim, which involved identifying relevant activity that supported the client’s claim in the face of systematic and secure deletion of hard evidence, as well as obtaining a court order to expand the investigation.
Consilio Response
The team took the former employee’s company cell phone and laptop and imaged and interrogated them. Nothing was found on the phone as it had been reset, and the laptop had been wiped of relevant files, therefore there was no hard evidence to support the client’s claims.
However, a thorough investigation of all aspects of the devices did uncover relevant, supporting evidence. Intellectual property in the form of data files, that included the client’s private contact list and financials, had been accessed on the morning of the former employee’s last day. The team was also able to identify intellectual property in the form of data files that were accessed by the former employee within three days of their last day and then kept in a folder on the suspect’s computer entitled “Take.” There was also evidence of secure wiping, that utilities had been installed to destroy data and that mass storage and copying devices had been connected and registered with the former employee’s computer within their notice period.
Based on the evidence that we provided, the client was able to obtain a court order to seize the former employee’s home computers and computers from the new business venture the former employee had since started. These were then analyzed to determine where the client’s information had been used, where it had been distributed and for what purpose.
Results Achieved
Our team identified and analyzed significant evidence to demonstrate the actions of the individual in question. We presented our findings to the client in a report that was easily understandable, which the client then used to negotiate a very favorable compromise agreement with the suspect.
.jpg)
.jpg)
