IP theft · designs · source code · client lists · exfiltration · preservation imaging
Intellectual property theft. Designs and client lists leave a trail when they are copied out, and the first job is to preserve it before anyone looks.
Intellectual property, a product design, source code, a client database, a pricing model, is often a business's most valuable asset, and when it is suspected of walking out the door the response has to be fast and careful in equal measure. Fast, because an injunction may be needed and because the evidence degrades with every use of the device; careful, because a clumsy first look can destroy the very trail that proves the point. The priority is a preservation image taken straight away, before anyone examines the machine. Then the standard forensic report sets out what the device records: removable storage connected and the protected folders opened from it, cloud and email used to send material out, access to the design or source directories, and any deletions. It is examined on the authority of the rights-holding business, whose devices they are, and it is written factually, with the limits stated: it shows material leaving the device, not its receipt or use by a competitor.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is the business that owns the intellectual property and the device, usually acting with its solicitors because an IP matter so often heads quickly toward an injunction. We ask for confirmation of company ownership of the device, the lawful basis, and the scope, the material of concern and the period.
The first step is preservation. Before anyone examines the device, we take a write-blocked forensic image and hash it, so the evidence is secured exactly as it was. That protects the position whether or not an examination follows immediately, and it is the single most important thing to get right in an IP matter, because an unpreserved device examined in haste can lose the trail.
We examine what the device records about material leaving it. We do not access a departing employee's personal accounts or a competitor's systems; those would require separate authority. What the device shows, removable media, cloud, email, folder access, is often what founds an application for relief.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| Whether protected material left the device | Removable media, cloud and email artefacts | That a competitor received or used it |
| Whether the protected folders were accessed | File-access artefacts and the timeline | Who accessed them, beyond the account used |
| When the activity happened | Timestamps across the artefacts | The intention behind it |
| That the evidence is preserved | A hashed, write-blocked image taken on day one | Anything not recorded on the device itself |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Preserve first, examine second. Have the device imaged before anyone opens it; this is the one thing that cannot be undone later.
- Move quickly if an injunction is in prospect; your solicitor will want the preservation image in hand.
- Do not confront or tip off before the device is secured; a wiped device helps no one.
A preservation image taken before anyone examines the device is the single most important step in an IP matter, securing the evidence exactly as it was.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Our designs have gone to a competitor. Can you prove it?
We can show, factually, what your device records about material leaving it: removable storage and the design folders opened from it, cloud and email used to send material out, and access to the protected directories. We cannot prove what a competitor received or used; that is a matter for disclosure against them. The device evidence is often what founds an injunction.
What should we do first?
Preserve the device and have it imaged before anyone examines it. The preservation image, taken behind a write blocker and hashed, secures the evidence exactly as it is, and it is the priority in any IP matter, especially where an injunction is in prospect.
Can you examine the competitor's systems, or the ex-employee's cloud?
Not without separate authority, their consent or a court order. We examine your own devices, which is where the evidence of material leaving usually sits. Disclosure against a third party is a matter for your solicitor and the court.
Will we need an expert report?
An IP injunction will usually need expert evidence in due course, written to the expert-evidence rules; that is quoted separately. The standard report, and above all the preservation image, come first and often support the initial application.
What does it cost?
The standard report for the device is £800 + VAT, with preservation imaging as part of it; a second disk is quoted as extra. An expert report for proceedings is quoted separately. The first conversation is free.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.