IP and Trade Secret Theft Investigations

Two separate questions arrive on this page and they are worth pulling apart on the first telephone call. The first is whether something left your business, by which route and under whose account. The second is whether your version of a design existed before somebody else's, which turns on dates and hash values and requires proving nobody's conduct at all. Clients almost always ring about the first. The second is answered more often, more cheaply, and in a good many disputes it is the one that settles the argument.

Preserve in week one. Argue in month three. £400 + VAT images, verifies, extracts and seals a device; £800 + VAT examines it and writes the report. The £400 is what a recorder drive or an encrypted volume costs. Free diagnostic, written scope. Forensic jobs sit outside no fix, no fee. Bands.

Start with the question that does not need a culprit

Where a rival product has appeared and your engineers are certain they saw it first, the useful exercise is frequently provenance rather than pursuit. Showing that a particular revision of a drawing, a model or a source tree existed in your possession on a given date draws on file system clocks, the change journal, the mail that carried it as an attachment, backup generations and version-control history, with a hash tying the copy you rely on today to the one described in the report. That is a narrow question with a clean answer and it costs a fraction of a full exfiltration investigation. It also survives the awkward possibility that nobody took anything at all and two teams simply arrived at similar geometry, which does happen, and which a report ought to be able to accommodate rather than argue past.

Nothing was broken into, and that is what makes it measurable

Intrusions are rare in this work. The access was granted, it suited the job, and somewhere in the final weeks it started being used for something else. So an examiner is not hunting for a forced door; the subject is a change in behaviour with dates on it, which is a much better thing to have. Scale is the usual tell. A repository taken in full where a branch would have done. A parts library copied wholesale by somebody who had spent two years opening three assemblies at a time. A customer table exported on a Tuesday evening by an account with no export history whatsoever. Set against half a year of that same account behaving ordinarily, the shift is a number rather than an impression, and numbers travel better in a witness box than adjectives do.

Six ways out of a building, and one of them is the printer

Material can only leave by a finite number of routes and each leaves its own kind of residue, so all of them get worked rather than whichever surfaces first. Removable media registers itself in the hive and drops shortcut records behind. A personal sync client keeps a local database of everything it mirrored and pushed up. Webmail leaves browser residue and now and then the attachment itself. Transfer services leave session entries. Version control writes clone and fetch lines against a named account on the server, where nobody sitting at the endpoint can get at them to tidy up. And the office printer keeps a spool and a job history that a startling proportion of investigations never look at, which is a shame, because a two-hundred-page print run at half past seven on a Thursday is not subtle. A case built on one channel falls over the moment the other side offers a second.

What a file quietly says about the desk it was written on

Contents are only half of what a document carries. Office formats and CAD files hold embedded properties: the author, the organisation, revision identifiers, template paths, editing history and often the original name and folder the file lived in. Drawings keep title-block entries and part numbering schemes that are peculiar to one company. Source files keep comments, naming habits and — in the cases that end quickly — the same mistakes. Where a competitor's document has reached you properly, through disclosure or because somebody simply sent it to you, those properties are compared against your originals and the relationship set out precisely. An unaltered file is settled by hashing and there is not much to argue about afterwards. An edited one is handled by near-duplicate comparison, which produces a degree of similarity rather than a yes, and the report says so in those terms.

The boundary, and why respecting it is in your interest

The instinct in these matters is to go and look at the competitor, and it has to be resisted. Nothing here is obtained by reaching into anybody else's systems, and material gathered that way does not quietly help the claim — it becomes a second argument running alongside the first, with the judge spending an afternoon on your conduct rather than on the drawings. The same limit applies to a departed employee's own laptop or private cloud account: those need their agreement, a protocol between the solicitors, or an order. What sits inside the line is everything your own systems and your own hardware recorded about the transfer, and in practice that is where the usable material has always been. Where an injunction or a search order is under consideration, solicitors will want the preservation in place before the application in any event.

The ceiling is fixed inside a fortnight and it never rises

This is the paragraph to act on rather than file. Server logs roll. Tenancy auditing expires on whatever schedule the licence dictates. Backup generations write over one another. The laptop at the centre of it is, while you read this, quietly consuming the free space an examination would have read. None of that comes back. So the maximum any investigation will ever be able to establish is decided in the first two weeks, by whether anybody thought to freeze things, and no amount of money spent in month four moves that ceiling by a single finding. Preservation is the cheap half and it can be arranged in days.

Method and custody sit on the forensic practice hub. Credentials and standing access are dealt with at insider threat forensics, removable media at USB device forensics, and the freezing step above is legal hold and chain of custody.

// signs that material is on the move

What product and engineering teams notice first

These are usually spotted by the people who handle the material daily rather than by anybody in IT. Freeze first, trace second, and speak to nobody until both are done.

An engineer or account manager who has resigned into a direct competitor
A parts library or repository copied whole where a subset was the norm
A rival quotation landing just under a number only three people held
A final month whose transfer volumes look nothing like the preceding year
Folders opened that sit well outside anything the role was ever given
A competing product whose tolerances and geometry sit awkwardly near yours
// sequence, and what happens when it is inverted

Four moves. Nearly every thin case did the last one first

There is nothing clever about the order. It is simply that three of these can be done next month and one of them cannot.

01

Freeze

Cancel the reimage tickets. Pull the audit exports. Hold the mailboxes. Image the machines. An hour's work, almost no money, and the only move with an expiry date on it.

02

Define

Settle what is being asked and across which weeks. In front of a judge, one narrow question answered without hedging beats five broad ones answered with qualifications.

03

Trace

Work every route the material could have taken rather than stopping at the first one that turns up, and fasten each finding to the artefact and the date behind it.

04

Speak

Last, once the other three are done. Putting it to somebody while the evidence is still on a live laptop is the most dependable way to lose the evidence.

// six parts of an IP instruction

What the report actually contains

Each part carries its date and its source, and the report marks the point where technical evidence stops and somebody would have to start inferring.

Bulk movement

A repository, a parts library or a database going out in a single operation.

Your own fingerprints

Part numbers, project code names and confidentiality banners found on an image.

File provenance

Embedded properties and revision identifiers linking a rival document to yours.

Routes taken

Stick, sync client, transfer site, webmail, printer — each with the hour it was used.

Recovered material

Deleted files and archives brought back wherever enough of them survived.

Who touched it

Openings, exports and print runs against protected material, each against a login.

// the fee, and who may lawfully ask for it

What it costs, and the authority it stands on

The figure most of these instructions end at

IP matters end in a document, so £800 + VAT is what nearly all of them cost: the examination and the written report, findings numbered, each fastened to a dated artefact, method set out in an appendix for an opposing expert to rerun. The other figure is worth knowing about anyway. £400 + VAT preserves a device properly — imaged, verified, deleted material extracted, sealed, logged — without asking it anything, and in the first fortnight of one of these disputes that is frequently the more urgent purchase. It is the price a recorder drive and an encrypted volume already carry rather than a band of its own, so the published table still runs to five prices and not six.

£400 + VATPreserve now, decide later. Capture, verification, extraction and custody, at the recorder and encrypted-drive price point.
£800 + VATThe examination and the report, run from the image already held. Nothing is acquired twice and nothing is paid for twice.

Neither figure falls under no fix, no fee, which covers logical recovery and publishes four exclusions: electronic and mechanical failure, chip-level work, DVR jobs and forensic jobs. In a design argument that matters, because establishing that your revision came first takes the same hours as establishing that it did not. One device and one question is the assumption behind both prices; a repository server, three laptops and a drawing archive is scoped in the free diagnostic and put in writing beforehand. The diagnostic costs nothing and closes two working days after booking in at Oxford.

Your own systems, and nobody else's

An IP instruction runs on systems and hardware the company itself owns, or on a solicitor's written instruction where proceedings are in prospect; an insurer or a court instructing in writing is the same route. A private client's own hardware is the third and it seldom features here. The boundary matters more on this page than most, because the temptation is to go and look at the competitor. Nothing is obtained by reaching into anybody else's systems, no password belonging to another party is defeated or guessed, no monitoring software is supplied, fitted or advised on, and live traffic is not intercepted, that being reserved by the Investigatory Powers Act 2016 to bodies no private laboratory belongs to. Material gathered that way damages a claim rather than advancing it. Phones and tablets are not examined here in any circumstances.

// IP and trade secrets — before instructing

What legal and product teams ask

Frequently, and it is worth asking for by itself. Dating a revision draws on file system clocks, the change journal, mail that carried the file, backup generations and version-control history, with a hash binding today's copy to the one the report describes. It answers a narrow question firmly, costs less than a full investigation, and — this is the part clients miss — it does not require establishing that anybody did anything wrong. In a design argument that is regularly the more valuable half.
Nowhere on its own, and it is better to hear that early. Resemblance becomes evidence at the point a rival file reaches you lawfully — in disclosure, or because somebody sent it — after which the embedded properties, revision identifiers, template paths and internal naming can be set against your originals and the relationship described. Unaltered, hashing settles it. Edited, near-duplicate comparison gives a degree of similarity and the report expresses it as a degree rather than a conclusion.
No to both, and the answer does not change with the fee. Somebody else's systems are somebody else's, and reaching in is unauthorised access under the Computer Misuse Act 1990. A former employee's personal machine needs their consent, a protocol agreed between the solicitors, or an order of the court. What is available without any of that is everything your own network and your own hardware wrote down, which is where the usable evidence lives anyway.
The expensive-to-lose half, and it costs nothing. Cancel the reimage and disposal tickets in writing. Export the tenancy audit records and put the relevant mailboxes on hold. Take the laptop out of service and leave it switched off rather than having a look through it. Note the resignation date, the last working day and the handover date. Then ring. The one thing to avoid is an internal investigation conducted on the live machine, because every look at it writes to the disk and becomes something an examiner has to explain away later.
Only as far as the records honestly reach, and the report is careful about the boundary. Your own systems can show that a named file was copied to a named volume at a stated hour, by a particular account, and that a personal sync client uploaded a folder of that size shortly afterwards. What happened at the other end is outside your systems and outside our reach. Where a competitor's copy later arrives through disclosure, the hash comparison closes that gap properly. Until it does, the report says what was established and where inference would have to begin, because a document that overstates one link is worth less than one that concedes it.
Faster than feels proportionate. Tenancy auditing expires on a schedule set by your licence, server logs roll, backup generations overwrite, and the laptop is eating its own free space while the decision is being taken. Preservation is inexpensive, can be arranged inside a few days, and protects material that no amount of spending will reconstruct later. Everything else can wait; that cannot.
// getting your media to Oxford

Posting a device in — what goes in the box

Freezing comes before packing on this kind of matter, so ring 0800 689 0668 first and we will work out what gets captured, in what order, and what genuinely has to be posted at all. Where a disk comes out of a machine, the disk travels and the machine stays with you. Coventry has no counter and nothing is collected anywhere in this network: tracked and insured post to Oxford, or handed in over the counter there in office hours, with the custody file opening as it is booked in.

As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.

  • Use a box or padded mailer with some rigidity to it, and pack around the drive until nothing shifts when the parcel is tilted. Mains adaptors, docks and leads are not wanted at this end.
  • Sending a RAID or a server? Only the member disks travel — not the chassis, not the controller — and each one wants its bay number written on it. Take a photograph of the front of the unit before anything is pulled; it costs nothing and now and again it saves a day.
  • Print the shipping and booking-in form (PDF), add a name, a number you will answer and a sentence on how the trouble began, and drop it in beside the media.
  • Most people use Special Delivery, which is tracked and covered; a courier of your own does the same job. You can also bring it: the Oxford reception takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Coventry counter nor a collection round exists.
// write this on the label

Oxford Data Recovery

John Eccles House
Oxford Science Park
Robert Robinson Avenue
Littlemore, Oxford, OX4 4GP

↓ Print the shipping & booking-in form (PDF)

Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.

Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.

Week one decides what month six can prove.

Freeze it, settle the question, work every route, and only then speak to anybody. One call will establish which windows are still open and which have already shut.