Purloined Intellectual Property

An engineer left an international technology company. He has access to the employer's design manuals, fabrication plans, quality assurance procedures, and client list. After his departure, an employee approached management to report that the engineer had been bragging about how much better he could sell the employer's product than the employer.

Following a recommendation that we make in e-discovery matters, the employer obtained a court order allowing them to create a forensic image (sometimes called "mirror" image) of the ex-employee's home computers and the computers of an alleged confederate. We created images of the three sets of computers (his computer at work, his computer at home, and the computer of his alleged confederate) using a standard forensic analysis tool.

We investigated the metadata (hidden but identifiable information about a file) in the manual in question and found that he had copied the design manual to a floppy drive, taken the floppy drive home, and moved the file to his home computer.

On his home computer, he divided the manual into separate chapters. He updated the chapters to more recent part numbers and to metric measurements. He sent the modified chapters to the confederate who then tried to market them in a third world country.

We were able to trace all of these transitions from the metadata. We also did an analysis of the document's development artifacts, such as misspellings, unusual formatting (or lack thereof), and inconsistent spacing and alignment.

We also examined email addresses on the three sets of computers. Using the email addresses we found, we identified another (heretofore unknown) confederate.

The case was eventually moved to criminal court.

To see the resume of the expert associated with this case study, see the link below.