An intellectual property theft investigation examines digital records associated with information counsel identifies as protected. Forensic Discovery helps law firms and businesses investigate suspected access, copying, transfer, use, or deletion of source code, designs, research, and other proprietary material.
We connect available file, device, repository, and account records into a documented timeline. The examination distinguishes what the records show from what remains uncertain. Counsel evaluates ownership, trade secret status, authorization, and the legal elements of a claim or defense.
Related scope. Our digital forensics services support disputes defined by counsel involving protected information. For an organizational response or a response to an employee departure, see business data theft investigations. Customer lists and pricing information may also be protected, depending on the facts and applicable law.
We examine available records associated with the files counsel identifies, including relevant versions and locations. File access, archive creation, downloads, and destination records may help reconstruct movement. We distinguish observed activity from an inference about acquisition, use, or disclosure; a technical finding does not decide whether misappropriation occurred.
Repository logs, local working copies, commit records, archives, computer-aided design (CAD) files, and engineering documents can provide different parts of the history. We assess whether retained records show a clone, export, transfer, or later activity. A repository event alone may not establish which person acted or what a recipient used.
We examine available USB history, personal email, cloud activity, compressed archives, and deletion or wiping traces within the authorized scope. A connected USB device does not by itself establish a file copy. Deleted material may be unavailable because of overwrite, encryption, retention, or device state.
A court order, agreement, or other valid authority defines the permitted sources and access. We can work within a protocol as a party examiner or neutral examiner, subject to engagement review. Counsel addresses privilege, protected material, reporting restrictions, and disputes over scope before the relevant work proceeds.
Under an agreed scope, we can search authorized systems for identified files and document specified removal and subsequent checks. Hash comparison can identify files with identical bytes in the searched material; changed versions need other methods. A negative search or completed removal step cannot certify that no other copies exist.
Counsel may need a focused technical record before a temporary restraining order or preliminary injunction hearing. We discuss the deadline, the files at issue, available sources, and the questions a declaration must address. A staged examination can separate initial observations from later analysis. Access, collection, review, and examiner availability determine what can be delivered; we confirm feasibility before committing to a date.
File movement and activity timelines can help counsel evaluate allegations involving confidentiality, non-compete, or non-solicitation terms. We report technical observations and plausible alternative explanations. Counsel interprets the agreement, applicable law, and the significance of the conduct. Our resource on legal and compliance considerations in departing employee investigations provides related context for planning led by counsel.
A receiving company or represented employee may need to investigate an allegation, identify material present in authorized sources, or document agreed remediation. We record search scope, matches, exclusions, and unresolved gaps. Findings may support a defense or a controlled onboarding process, but a search with no matches does not establish that a person never possessed or used protected information.
Disputes involving a founder, contractor, former employee, licensee, or joint venture partner may require a defined examination protocol. We help counsel assess technical feasibility, source access, search methods, and reporting limits. Party and neutral roles have different instructions and disclosure paths. We document the applicable role and restrictions rather than assuming that access to one side authorizes examination of the other.
Coordinate preservation tailored to each source with counsel and an examiner before routine browsing, device reassignment, resets, or other changes that could affect records. Handling depends on the source and its current state.
Related examination and response. See business data theft investigations for organizational response context and computer forensics for the underlying device examination.
| Source | Available evidence | Interpretation limits |
|---|---|---|
| Engineering workstations and laptops | Local files, archives, file activity, attached storage, and available application traces. | Device activity needs corroboration; collection coverage, clock settings, encryption, and overwrite affect interpretation. |
| Code repositories and version control | Retained access, clone or export events, commits, and available working copies. | Logging varies. Account activity alone does not identify the person or prove later use. |
| File servers and shared drives | Available file versions, permissions, access events, and transfer records. | Retention and auditing determine what survives; a filename match is not a content match. |
| Microsoft 365 and Google Workspace | Available file, email, sharing, and account activity within authorized tenant scope. | Permissions, licensing, retention, and collection route affect coverage. |
| Personal cloud or email used on company systems | Available local traces and authorized account material relevant to a suspected transfer. | Access to a company device does not automatically authorize access to a personal account. |
| Recipient or new employer systems | Identified files, relevant versions, and activity within an authorized protocol. | Examination depends on valid authority and reporting restrictions; unavailable systems remain a gap. |
Related sources and services.
Where relevant and authorized, mobile device forensics can address phone evidence. Cloud-based forensics addresses company tenant sources. Mailbox acquisition for a production is a separate forensic email collection task.
Large downloads, new archives, personal cloud use, access outside working hours, log deletion, and activity near departure can justify closer examination. Each also needs context. An indicator is a lead to test against authorized work, automated activity, retention settings, and other available records.
Planning resource. Our departing employee investigation guide offers related planning context; handling for each source should be agreed with the examiner.
Depending on the engagement, deliverables can include an evidence inventory, file comparison results, a timeline linked to its sources, a written report, a declaration, rebuttal analysis, or a neutral examiner report. Expert witness and testimony services can support depositions and trial. Counsel controls legal arguments and disclosure decisions. Collected material can also move into eDiscovery review under the agreed scope.
Forensic Discovery connects the examination to the disputed information and the questions counsel needs to evaluate. We document methods, supporting records, and limits so findings can be examined and challenged. Scoping addresses the relationship between source access, protocol restrictions, deadlines, and the intended deliverable. The work follows the evidence whether an observation supports an allegation, supports a defense, or leaves a question unresolved.
We work with outside counsel, IP and employment litigators, internal legal teams, and business leaders coordinating with counsel. Forensic Discovery works with law firms and businesses only and does not accept direct individual consumer matters. If a law firm represents an individual, the firm may contact Forensic Discovery about the matter. See our offices and service locations for location information.
Ask for a written scope and estimate before work begins. Cost depends on custodians and devices, repository and file volumes, source access, protocol restrictions, hearing dates, and the depth of analysis. Reports, testimony, neutral reporting, and remediation checks can require separate work. We discuss a focused initial phase when appropriate and identify what it can answer, what it excludes, and which later steps would need authorization.
The examination begins with the information counsel identifies and the questions the matter presents. We correlate available file contents, access records, transfers, and timelines, then explain what supports or weakens a proposed account of events. Access is different from copying, and a transfer record is different from proof of use. Counsel evaluates trade secret status and legal elements; the examiner reports technical findings and their limits.
Bring in an examiner while counsel is defining the urgent questions. We assess authorized access, source condition, collection needs, file identification, and the available review time before confirming a deliverable date. A tightly scoped initial declaration may address fewer questions than a full investigation. We identify unresolved analysis explicitly. No fixed turnaround applies to every intellectual property theft investigation, and a hearing date does not remove access or review requirements.
Only with valid authority covering those sources. Counsel may arrange an agreement, stipulated protocol, court order, or other appropriate basis for the proposed access. The examination must follow its terms, including restrictions on searches, protected material, and reporting. Possessing credentials or owning a different device does not establish authority. We can discuss a party or neutral role, subject to the engagement and protocol.
Retained repository events, local working copies, archives, and destination records may support that conclusion for identified material. Coverage depends on logging, retention, permissions, and which systems are available. We distinguish repository access from a completed clone and a clone from later use or disclosure. Exact file hash matches can connect files with identical bytes, but changed versions or partial extracts may require other comparisons and cannot be excluded by a hash search with no matches alone.
A protocol defines the permitted examination: sources, custodians, relevant dates, search methods, protected information handling, and reporting recipients. It may also set procedures for disputes, privilege review, and remediation. Counsel and any applicable order determine those terms; we address whether the technical steps are feasible. A protocol limits the work, so a report should explain what was examined and what remained outside scope rather than imply complete visibility.
We can examine identified, authorized sources and report the searches performed, material found, and limits of the result. A negative search applies to that searched material and method at the time of examination. It cannot prove a person never possessed, transferred, or used other information. If remediation is agreed, we document the specified removal steps and checks without certifying that no copies exist elsewhere.
This service focuses on disputes over protected information identified by counsel, including source code, designs, research, and alleged trade secret misuse. Business data theft investigations address the broader organizational response or a response to an employee departure. The subjects overlap: customer lists and pricing may be protected depending on the facts and applicable law. Counsel determines the legal classification; the forensic scope follows the sources and questions rather than a categorical label for a file type.
The main drivers are the number of custodians and devices, repository and data volumes, available source access, protocol restrictions, and the analysis required. Hearing deadlines, report preparation, testimony, and remediation checks can change the work involved. Confirm the proposed scope and pricing before starting. A phased approach may help prioritize an urgent question, but its report must retain the exclusions and unanswered questions from that phase.
The court decides admissibility under the rules and circumstances of the case. Documented collection, chain of custody, source support, and explained methods help counsel evaluate and present the work; none guarantees acceptance. Hashes support comparisons of the material hashed and do not establish completeness or legal sufficiency. Our resource on metadata in civil litigation explains related evidence context without replacing review of the particular matter.
Forensic Discovery offers expert witness and testimony services, including agreed declarations, reports, deposition support, and trial testimony. The examiner addresses the technical work and supported opinions within the engagement. Counsel determines the claims, legal positions, disclosure obligations, and proposed use. Neutral reporting follows the governing protocol. Availability, qualifications for the assignment, and the requested deliverable must be confirmed for the particular matter.
Discuss an intellectual property theft investigation with our team. Counsel can describe the information at issue, custodians, available sources, and any hearing dates. Use this form for a general inquiry; arrange an appropriate transfer method before sending protected files.
"*" indicates required fields
(866) 458-4993 
