When Trusted Employees Turn
While we now do more work for defendants accused of intellectual property theft than we once did, the majority of our cases still come from businesses and their attorneys who are victims. It never stops being surprising how often employees feel entitled to take what they worked on, or simply decide to steal outright, all while still on the company’s payroll. Sometimes, it’s even more blatant than usual.
This case is one of those times.
A Client Prepared, and a Critical Pause
This investigation began with a long-time client who already understood the importance of data protection. We’d helped them in the past with data policies, procedures, and routine reviews of departing executives’ devices.
One day they received a call from one of their long-standing customers. That customer had just been approached by a recently departed mid-level sales employee, now trying to lure them away to a new business he had started. It was a refreshing reminder that strong business relationships still exist, the client immediately called us.
Because they had listened to our recommendations, the client’s IT team had held off repurposing the ex-employee’s laptop. They had a solid policy in place requiring a cooling period of 60 to 120 days for devices used by employees who might have had access to sensitive data. Think of it as insurance for evidence.
Digging In: The Investigation Unfolds
We got started with our standard process: forensic imaging, indexing, and a detailed review of data access, especially any involving USB devices. We did find that the employee had used a thumb drive and failed to return it, which was an issue, but the volume of data on it wasn’t suspicious.
The real surprise came from reviewing the computer’s network activity logs. Instead of local network traffic, we found extensive connections to a mapped drive, the employee’s home network server.
They had been copying increasing amounts of data from the company laptop to this home device over the last few months. Even after they left, the files were still on the laptop. Using forensic artifacts, we were able to build an index of what was on the home server, all without ever touching it. That was just the start.
A Partner Emerges And Evidence Builds
While sifting through these files, we started seeing the name of another salesperson, either in the content itself or in folder structures. After more than 25 years in this field, that’s the kind of detail that makes you lean in closer.
When we shared this with our client, it clicked. That second salesperson had left shortly after the first. We examined their machine too, and what we found changed everything: fragments carved from unallocated space formed a nearly complete business plan for their new venture.
From details in that document, we traced activity back to the first laptop and discovered the two had even set up new vendor accounts for their startup, undercutting their old employer.
A Costly Irony And a Fast Resolution
One detail stood out. The two had used their own 401k funds to finance the new business, through what’s known as a ROBS plan (Rollover as Business Startup). Since their former employer offered a 401k match up to 4%, the company had unknowingly helped bankroll their employees’ plan to compete against them.
Fortunately, armed with this clear, well-documented evidence, the client’s attorneys were able to move quickly. Litigation was filed. But almost as soon as it started, it ended. The matter was resolved with an agreed judgment and a permanent injunction in the client’s favor.
Why Paying Attention Matters
This case underscores the value of being able to interpret complex data, explain it clearly, and catch small but critical details that others might dismiss. Too many investigators simply run through a checklist, missing subtle patterns. We take pride in doing more because those details can decide a case.
We enjoy helping our clients come out on top.
About Swailes Computer Forensics
Swailes Computer Forensics provides expert digital forensic services to law firms, corporations, and organizations nationwide. Our work includes investigations into intellectual property theft, employee misconduct, data breaches, and more. With decades of experience and a commitment to integrity and clarity, we help clients uncover critical evidence and take informed action.
If you’re facing a potential case of employee data theft or have concerns about unauthorized activity, contact us for a confidential consultation.