Computer Forensic Examination Confirms Theft of Confidential and Trade Secret Information

When two employees resigned from a large North American company and created their own competing company, the company suspected they may have taken confidential trade secret information in violation of their written confidentiality and non-competition agreement.

The company retained bit-x-bit to conduct a forensic investigation of the former employees’ laptops and smartphones.  Our forensic investigation determined that multiple USBs had been inserted into the their just prior to their departure from the company, some of which likely contained back-ups of the company’s documents and files. Contrary to the employees’ representations to the company, bit-x-bit determined: 
  • Weeks before their departure, both employees accessed and deleted several confidential, proprietary documents.
  • On the date that one employee resigned, he conducted a Google search for “how to wipe a hard drive” and subsequently visited two websites which described the process.
 • Both employees’ smartphones were reset to factory condition, thus deleting all user information from the smartphones. 

With these findings, the court entered a stipulated temporary restraining order (TRO) under the recently enacted Defend Trade Secrets Act, 18 U.S.C. § 1836 (2016), against the defendants.  The TRO restrained the defendants from disclosing confidential and trade secret information and enjoined them from engaging in violations of their employment agreements with the corporation.