Corporate Espionage Investigation: What the Evidence Must Prove

Corporate espionage investigations are usually sold as intelligence work: who took it, who paid them, what the competitor is doing with it. The work that decides whether any of that matters is considerably duller. It is a dated list of what the company classified as secret, a dated list of what left the building, and a defensible answer to the question of when the company first had enough information to sue. A file with a dramatic narrative and a soft preserve record loses; a file with a boring timeline and a hash for every exhibit wins injunctions.

The 2026 case law is unusually clear about which of those two files courts reward. On 3 June 2026 the Federal Circuit reversed a jury verdict worth 59 million dollars against EOFlow in Insulet's Omnipod case, a 2-1 decision by Judge Dyk, not because the misappropriation finding was wrong but because Insulet knew or should have known more than three years before it filed, and the Defend Trade Secrets Act puts a three-year limit on the claim. The jury had found four trade secrets misappropriated: CAD files, a soft cannula design and its manufacturing process, a design history file, and an occlusion-detection algorithm. The original award was 170 million in compensatory and 282 million in exemplary damages, reduced by the district court to 25.8 million and 33.6 million. A technical case that good, lost on a date. In the same year the Ninth Circuit vacated a 40 million dollar verdict against XP Power on 14 July, and the Western District of Washington upheld 1,916,137 dollars in Silver Fern Chemical v. Lyons on 25 August, where a departing employee downloaded a customer pricing folder before giving notice and the court held that a compilation of semi-public customer names with non-public margin, vendor pricing and order-frequency data was a protectable secret. Verdicts in this field move by a factor of forty on questions of timing and proof, not on questions of villainy.

That is the argument of this guide. An espionage investigation is a measurement exercise with a legal deadline attached, and it has five deliverables a court can audit: the asset list and what was done to protect it, the first and last unauthorised access, the transfer evidence per channel, the destination evidence, and the date the company knew. Everything else, the actor profile, the foreign handler theory, the competitor's product launch, is context. Context is worth having. It is not what an injunction hearing turns on, and it is not what a prosecutor needs.

The reason to set this down in this much detail is that most of the damage is done before anyone calls an investigator. A human resources team that collects a laptop and runs the standard wipe script destroys the plaintiff's best exhibit. An information security team that resets the leaver's password and revokes the session kills the cloud sync records that would have shown the upload. An organisation that has never written down which of its information is secret cannot answer the first element of the statutory test, however good the forensics are afterwards. The sections below follow the order the case actually develops, from the two questions that have to be answered in the first hour to the programme that stops the next file from existing.

What the investigation must produce, stated as a checklist

Before anything is collected, the engagement should be able to say what the finished file will contain. In a trade secret case there are six items, and each has a form that either survives a hostile reading or does not.

First, the classified asset list with dates: every item claimed as a trade secret, the date it was created, the date it was designated, the systems that stored it, and the population of people with access at each point. Second, the reasonable-measures record: what the company actually did to keep each item secret, with evidence rather than policy language, meaning the access control configuration, the signed agreements naming those individuals, the exit interview records, the physical controls and the marking standard. Third, the access timeline: first and last unauthorised access for each claimed item, sourced to a specific log line or artefact, distinguishing the event time from the time the company learned of it. Fourth, the transfer evidence per channel: removable media, email, cloud sync, code repository, print, screenshot, photograph and physical removal. Fifth, the destination evidence: where each transferred set went, to the extent it can be established without touching anyone's personal accounts. Sixth, the knowledge date: the point at which the company had enough to start the three-year clock, with the document or message that shows it.

Two of those six are frequently missing entirely, and they are the two that lose cases. The reasonable-measures record is missing because most companies have never assembled it, and it cannot be assembled retrospectively, since a policy adopted after the theft proves nothing about measures taken before it. The knowledge date is missing because companies treat "we suspected something in 2023" as an internal embarrassment rather than as a legal fact with a deadline attached, so nobody writes it down, and later nobody can prove when it happened.

It is worth being blunt about what an investigation cannot deliver. It cannot tell you what a competitor is doing with a process, because that requires evidence from the competitor. It cannot establish a foreign state's involvement from a laptop, and an attribution theory that outruns the evidence is the fastest way to make a good file look like speculation. It cannot recover data that was never logged, and it cannot make a claim viable where the company's own conduct destroyed the proof. Buyers who want those things are buying a story. Buyers who want the six items above are buying a case.

The first hour: what to do before anyone images anything

The first hour decides more of the outcome than the six weeks that follow, and the correct sequence is counter-intuitive because the instinct is to grab the device. Devices are patient. Live state is not.

The order that works is: preserve the identity and mail platform's audit configuration as it currently stands, because the next administrator to tidy the tenant may switch off unified audit logging and take the records with it; export the relevant mailbox audit, message trace, sign-in and device registration data to write-once storage; capture the file server and document management access logs for the claimed assets; capture the cloud storage and SaaS audit logs for every service the person used; then move to endpoint collection. Every step needs a hash and a collection record naming collector, time, source and destination, because Federal Rule of Evidence 902(14) allows electronic evidence to be authenticated by a digital identification process rather than by a live witness, and the hash plus the process record is what that rule asks for.

Three decisions belong in the first hour rather than later. Whether the matter is engaged through outside counsel so the work product can sit under privilege, which changes who receives the findings and how the report is written. Whether the subject is still employed and, if so, what the company tells them and when, because the notification itself changes behaviour and can be the event that triggers a wipe. And whether law enforcement is going to be involved, because the Bureau asks to be contacted early and the timing affects how witnesses are interviewed and how evidence is packaged. The FBI's own guidance points at the same three things from the other side: mark sensitive material, limit and monitor access, train employees, run an insider threat programme, and report early rather than after the information is irreversibly gone.

What must not happen in the first hour is the well-meant clean-up. Do not reset the leaver's password before the session tokens and sync records are captured. Do not run the standard offboarding script that wipes the device. Do not let the person's manager look through the shared drive using the person's own credentials. Do not delete the personal-account emails found in the corporate mailbox, because they are now evidence and their headers carry the destination. Each of those actions feels like containment and is in fact destruction, and the destruction is usually provable from the very logs the company preserved about its own administrators.

The clock starts at suspicion, not at the lawsuit

The single most expensive date in a trade secret case is the day the company first had enough information to be on notice, and it is almost never the day the complaint is filed. Under 18 U.S.C. section 1836(d) a civil action may not be brought more than three years after the misappropriation was discovered or, by the exercise of reasonable diligence, should have been discovered. That is a discovery rule, not an injury rule, and it runs from suspicion rather than from proof.

The Insulet reversal is the clean illustration because the merits were strong. Former employees, including a director of mechanical engineering, moved to a competitor that then produced a strikingly similar patch pump, and a jury found four trade secrets misappropriated. The Federal Circuit held the claim barred because the plaintiff knew or should have known more than three years before filing that a former employee with access to its secrets was working for a competitor that had developed a strikingly similar product. Read that holding as an investigation requirement and it becomes actionable: the file must establish, with dates and documents, when the company learned each of the facts which together amount to notice, being a departure, a destination, an overlap, a product and a similarity. If the sales team knew in 2022 that a rival had launched a near-identical line and the legal team first heard in 2025, the clock started in 2022, and the internal silence is the defendant's best argument.

There is a practical consequence that good investigators build into the engagement: interview the business before you interview the systems. Ask product management when a competitor's feature first looked familiar, ask sales when a customer mentioned being approached, ask engineering when a build began failing in an odd way. Those answers define the knowledge window, and the knowledge window defines which logs you need and how far back the preserve has to reach. It also protects the client from an unpleasant surprise late in the engagement, because the earliest of those dates is the one a defendant will find in discovery whether or not the plaintiff's own file mentions it.

The other clocks are shorter and easier to miss. An injunction application moves in days, and the evidence has to be packaged for a hearing rather than delivered as a data dump: the Silver Fern case, an ordinary mass-departure matter, took from a 2023 filing to an August 2026 ruling on the renewed motion, which is three years of litigation that a plaintiff only reaches if the preserve held. Criminal referral to the Bureau or to a United States Attorney's office runs on its own timeline and benefits from a package assembled to their standard rather than to a civil litigator's. Where the company also operates in the European Union, the civil claim follows national procedural rules, and the limitation periods common there do not make the preserve question any less urgent, because evidence decays on the same schedule everywhere.

Reasonable measures is the element clients lose on

The statutory definition of a trade secret has three parts, and companies obsess over the first two. Under 18 U.S.C. section 1839(3) the owner must hold information that derives independent economic value, actual or potential, from not being generally known and not being readily ascertainable by proper means, and must have taken reasonable measures to keep that information secret. The third clause is the one that fails, and it fails for a reason that has nothing to do with security budgets: nobody can produce the evidence.

Reasonable measures is not a security posture. It is a documented set of acts, proportionate to the value of the asset and to the threat, applied to the specific items claimed. Courts have treated as relevant the existence and enforcement of confidentiality agreements naming the information, access restricted to those with a need to know, marking or designation, physical or logical separation, exit interviews that specifically address the material, and a record that the company actually enforced those controls rather than tolerating breaches. What has repeatedly sunk claims is the failure of enforcement: an NDA on file, signed by everyone, in a company where marketing routinely emailed the pricing model to distributors.

The way to make this auditable is to turn it into a count rather than an adjective. For each claimed asset, record the control set that applied, the population under each control, the last date the control was tested, and the exceptions found. Then present it as a table with a denominator: of 41 designated assets, 38 were stored in access-controlled repositories, 36 had a signed NDA naming the designated category, 33 had been subject to an exit interview that referenced the category, and 9 had any enforcement action recorded in the past three years. That table tells a judge exactly how seriously the company took its own secrets, and it is also, incidentally, the honest starting point for the remediation the investigation will recommend.

The same requirement exists outside the United States in different words. Directive (EU) 2016/943 defines a trade secret, in Article 2(1)(c), as information which the holder has taken reasonable steps under the circumstances to keep secret, and its Article 4 catalogue of unlawful acquisition turns on unauthorised access and breach of a duty of confidence. In the United Kingdom, where there is no trade secrets statute, the action is breach of confidence, and the three-part test from Coco v. A.N. Clark (Engineers) requires the information to have the necessary quality of confidence, to have been imparted in circumstances importing an obligation, and to be used without authorisation. In all three systems the company's own conduct is an element of the claim rather than a mitigating factor.

Preserve before you investigate: the artefacts that decide the case

An espionage file is built from a small number of artefact families, and each one answers exactly one question. Investigators who know which artefact answers which question collect in the right order and stop when the question is answered. Investigators who collect everything produce a 4 TB image, a large bill, and a report that cannot point at a single line of proof.

Access is answered by file system and platform audit records: the document management system's version history and download log, the file server's access auditing, the SharePoint or Drive sharing and download events, the repository's clone and audit events. Transfer is answered by device artefacts and network records: registry keys that list every removable volume ever attached, shell link files that record recently opened documents including ones on removable media, the NTFS index entries that survive deletion of a file name, print spooler records, clipboard and screenshot tool traces, proxy and firewall flow records showing upload volume to a service the business does not sanction, and cloud sync client logs naming the account and the files. Destination is answered by email headers and message trace, by the sync client's account identifiers, and by the file names in the destination where a legitimate source can establish them. Intent, which is not an artefact but an inference, is answered by the timeline: the sequence of searches, downloads, competitor contact and resignation.

The practical rule is to collect in the order the evidence dies and to stop at sufficiency. Volatile state goes first, then platform logs that roll over on a retention schedule, then endpoint artefacts, then disk images. On a well-run Windows estate the file system artefacts survive longest, which is fortunate because they carry the most probative material, and the platform logs that prove access are usually the shortest-lived thing in the case. Where the collection has to be commissioned rather than run internally, see our digital forensics services for the scope of what a targeted collection covers.

Removable media: the arithmetic of USBSTOR and the link file

The most commonly used transfer channel in departing-employee cases is still removable storage, and it is also the best documented, because Windows keeps a durable record of it. The USBSTOR registry key records every mass storage device ever connected to a system, with a device instance identifier that includes the vendor, product and serial number. The setupapi logs record the first installation of each device with a timestamp. Shell link files in the user's recent items and the jump lists record documents opened from a removable path, including the volume serial number and the file name. The NTFS index attribute of a directory retains the names of files created and deleted in that directory, so a file that existed for four minutes and was deleted still leaves its name and timestamps behind.

Those four artefacts combine into a defensible chain: a specific device with a specific serial number was first attached at a specific time, a set of specific files was opened from a path on that volume, and the directory index shows those file names having existed on the local disk in the window before the device was attached. That is not a guess about intent. It is a sequence of times and identifiers, and it is the kind of evidence a court can follow.

The arithmetic that matters in the report is coverage, not drama. State the number of devices found, the number of files with a removable-media path in the link data, the number of those that map to designated assets, and the number that could not be resolved because the artefact was absent or the file name was generic. A report that says "thousands of files were copied to a USB drive" and cannot name the drive, the serial number and the time window will be attacked on the first motion, and the attack will succeed because the phrase describes a feeling rather than a finding.

Two limits belong in the same section because they are constantly confused. The device record proves attachment and, through volume identifiers, the device that a file was opened from. It does not prove that a file left the building: a USB drive attached at 14:02 and removed at 14:06 may have carried nothing, and the honest finding is that a transfer opportunity existed with these candidate files. The second limit is encryption: a device that was BitLocker-protected and had already been unlocked on that machine leaves the same artefacts, and the analysis should say so rather than implying that the data was necessarily readable elsewhere.

Email and cloud: the forwarding rule and the sync client

Email is the channel people think of and the one that produces the least volume but the cleanest evidence. The artefacts that matter are message trace records showing messages to a personal domain, Exchange or Microsoft 365 unified audit events for mailbox rule creation, mailbox audit records for delegate and send-as activity, and the rules themselves, because an auto-forwarding rule to a personal address is both an exfiltration mechanism and an admission of planning. A rule created two days before the resignation, scoped to messages containing a project name, forwarding to an external address, is one of the most persuasive exhibits available in this kind of case, and it is recoverable long after the person has gone because mailbox configuration is stored server-side.

The cloud channel is now larger than email and harder to read. Personal cloud sync clients run on corporate machines and record their own activity: the account that was signed in, the sync root, the files enumerated and the timestamps. Windows records the client's execution and its file system interactions, and a personal-account OneDrive, Dropbox, Google Drive or MEGA client leaves a trail in the user profile, in the application's own log directory and in the shell's recent-file records. Where the business sanctions the service, the tenant audit log is the better source, because it records the upload event itself rather than the local client's view of it.

Consumer upload services with no client are the difficult category, best evidenced by network records rather than by endpoint artefacts: a proxy log showing a sustained outbound transfer to a file transfer site, incomparable in volume with that user's baseline, is the finding. It establishes that data left, not what data. The report should separate those two propositions explicitly, because a finding of exfiltration without a finding of content is still enough to support an injunction and a further discovery application, and pretending to know the content is how a witness loses credibility on cross-examination.

Code: what a repository actually remembers

Source code cases are lost and won on repository archaeology, and the good news is that a modern repository remembers more than its administrators expect. The audit and event logs of a hosted service record clone, fetch, download, fork and permission change events with actor and time. Local repository metadata on the endpoint retains reflog entries, stashes and unreachable commits, so a branch that was created, committed to and deleted before the departure can often be recovered from the pack files. The working copy also leaves artefacts outside the repository: build outputs, package caches, IDE workspace state and the shell's recent-file list of consumed source paths.

The comparison question, which is whether code at the destination was derived from code at the origin, is an analytical problem rather than a collection problem. The useful evidence is structural rather than textual: identical module decomposition, the same unusual identifier names, the same deliberate workaround for the same obscure bug, the same comments including misspellings, the same magic numbers and the same test fixtures with the same invented names. A plagiarism score alone invites the independent-development defence; a set of specific shared idiosyncrasies that have no functional reason to coincide is much harder to explain, and the report should present them as a list rather than as a percentage.

Two cautions. Repository evidence is only as good as the client's access records: if contractors were given personal access tokens with organisation-wide read scope, the log will show a token's activity without proving which human used it, and the report needs to say that. And clone events are not downloads of your code: a public repository cloned before the individual joined is not evidence of anything, so the analysis has to be transactional, mapping each event to a date after access was granted and to content that was secret at that time.

The offboarding window is a measurable interval, not a policy

Espionage cases cluster around the exit, and the clustering is measurable. CERT's research on its insider threat case repository found that a majority of intellectual property thieves in its set took the information within a month of resigning, and that is the strongest argument for treating the notice period as an evidence window rather than as an administrative process. The often-quoted figure that a large majority of departing employees take data comes from a 2009 Ponemon Institute survey sponsored by Symantec, which asked 945 United States adults who had left a job in the previous year; it is seventeen years old and the sampling frame is soft, so it should be quoted with that caveat or not at all. What is current is the direction of travel: the Verizon 2026 Data Breach Investigations Report counts internal actors in 12 per cent of breaches, and CISA's Insider Threat Mitigation Guide, updated in September 2026, notes that annual losses are hard to quantify because insider incidents are significantly underreported.

The remedy is not surveillance of everyone. It is a defined interval with defined controls: on notice, the risk-bearing accounts are reviewed for download volume against their own baseline; on the final day, access is removed at the moment of the exit conversation rather than at the end of the day when the batch job runs; devices are collected and imaged or at minimum preserved before any wipe; the mailbox is retained rather than deleted; and the exit interview records, in the leaver's own words, that designated categories were not retained outside company systems. That last item is worth more than it looks, because it creates a written representation that can later be tested against the artefacts, and a lie in it is itself probative.

Where the company knows a person is joining a competitor, the interval extends: monitor for a defined period after departure on the accounts that remain, and check whether the new employer's job postings, product launches or patent filings reference work that only your data would explain. That monitoring must be of public information and your own systems. Watching a former employee's personal accounts, or asking a contact inside the competitor to look, converts a clean case into a liability of your own.

The spoliation trap: when the company destroys its own case

The most common self-inflicted wound in these matters is operational hygiene applied at the wrong moment. Mobile device management platforms are configured to wipe a device when it is removed from the fleet, so returning a corporate laptop to the pool on the leaver's last day can erase the browser history, the sync client logs and the file system artefacts in a single automated step, with no human intention and a perfectly ordinary audit trail. Mailbox deletion policies, retention labels that purge after thirty days, and the recycling of a laptop to the next employee all do the same thing at scale.

Once the information is gone, the question becomes procedural rather than technical, and the procedure has teeth. Under Federal Rule of Civil Procedure 37(e) a court may order measures to cure prejudice where electronically stored information that should have been preserved is lost because a party failed to take reasonable steps, and may go further, including an adverse inference instruction, dismissal or a default judgment, only on a finding that the party acted with intent to deprive. The gap between those two tiers is where most sanctions motions live, and the practical lesson for the client is that the first tier is nearly automatic once loss is shown, while the second turns on whether the loss looks like routine automation or like a decision made by a person who knew better. A wipe script that ran because the asset management system said so is a defensible mistake. A wipe script that ran two days after counsel sent a preserve notice is not.

The mechanism that prevents all of this is unglamorous and takes an afternoon to write: a standing suspension procedure that any of three named people can trigger, which freezes the device, the mailbox, the cloud account and the repository identity before any offboarding task touches them, with an automatic confirmation back to the requester. The procedure should name the person who owns it, the systems it covers, and what happens if the request arrives after the asset has already been reassigned. Organisations that run this once as a drill discover, reliably, that their offboarding workflow has three separate paths that wipe a device, and that two of them are triggered by people in human resources who have never heard of a litigation hold. The trigger also belongs in the incident response plan, so that preservation runs in the same sequence as containment rather than after it.

Lawful collection inside the employment relationship

An investigation is only as useful as the evidence is admissible and the collection is lawful, and the two are not the same test. A company has broad authority over its own systems, but that authority is bounded by contract, by statute and, in much of Europe, by collective agreement. Getting this wrong produces the worst outcome available: proof that cannot be used, plus a counterclaim from the subject.

The foundation is a policy that was in force before the conduct, notified to the employee, and specific about monitoring rather than a general statement about acceptable use. It should say that company systems and accounts are subject to monitoring and preservation, that personal use is permitted or not, and how investigations are conducted. Then the boundary that is most often crossed: the company's right to examine its own mailbox does not extend to the employee's personal email account, personal cloud drive or personal phone, even when the corporate device holds the credentials. Obtaining that content requires the account holder's consent or a court order, and an investigator who "just logs in" to a personal account has created a problem that no amount of good forensic work will fix.

In the European Union the constraint is structural. Article 88 of the GDPR allows member states to provide more specific rules for processing in the employment context, and several have. In Germany, section 87(1)(6) of the Works Constitution Act gives the works council a right of co-determination over technical devices designed to monitor employee behaviour, which means an investigation plan involving endpoint monitoring may require agreement before it starts rather than after. Austria, France, the Netherlands and Italy each impose their own notification, proportionality or prior-consultation requirements, and proportionality is the common thread: a targeted examination of one mailbox for a defined period, for a defined purpose, on documented grounds, is a different proposition from a company-wide sweep. Build the proportionality reasoning into the engagement letter, because in these jurisdictions the reasoning is judged on its own terms and cannot be retrofitted.

Cross-border cases: two statutes, one victim, four jurisdictions

When the destination is outside the country, the investigation has to be built for two audiences at once, and the criminal statute chosen by the prosecutor shapes what the file has to prove. The Economic Espionage Act has two theft provisions that look similar and are not. Under 18 U.S.C. section 1832, theft of trade secrets, the government must show intent to convert a secret related to a product or service in interstate or foreign commerce to the economic benefit of anyone other than the owner, with intent or knowledge that the offence will injure the owner, and the penalty for an individual runs to ten years. Under section 1831, economic espionage, the additional element is intent or knowledge that the offence will benefit a foreign government, foreign instrumentality or foreign agent, and the maximum rises to fifteen years and a five million dollar fine for an individual. Those figures, and the organisation-level maxima, come from the statute itself and are set out in the Congressional Research Service's overview of the Act.

The difference matters to the investigator because foreign-state involvement is an element that has to be evidenced rather than asserted. That evidence rarely sits on the endpoint. It comes from communications with a handler, from travel records, from tasking instructions, from the nature of what was taken, and from financial flows, and in practice much of it sits with the government rather than with the company. The company's contribution is the part it controls: an accurate asset list with valuations, a clean attribution of what left and when, and a package the Bureau can build on. Sales-pitch material about state sponsorship, unsupported by anything but the destination country's name, damages the file.

Civil enforcement across borders creates its own arithmetic. A judgment obtained at home may be unenforceable where the defendant's assets are, and the cost of parallel proceedings in two or three jurisdictions can exceed the value of the claim. Evidence held abroad is subject to that country's rules, and a company that instructs a local manager to pull files from an overseas subsidiary's systems may be doing something lawful in one jurisdiction and prohibited in another, particularly where data protection or blocking statutes apply. The engagement should identify, at the outset, where the evidence physically sits, where the entity that holds it is incorporated, and which regulator or court can compel production, because those three answers decide whether the case is viable before any forensic work is commissioned.

Independent development and the timeline that defeats it

The defence that ends most trade secret cases is not an attack on the forensics. It is the claim that the defendant developed the thing itself, cleanly, from public information and its own engineers, and that the resemblance is a coincidence of engineering constraints. Investigating for that defence means investigating the timeline, because independent development leaves a trail of its own: design reviews, prototyping iterations, failed approaches, test data, purchase orders, hires, and crucially the time that all of it takes.

The plaintiff's strongest argument, where the facts support it, is temporal impossibility. If the competitor's product reached functional prototype nine months after a mass departure, and the industry norm for that class of development is measured in years, and the competitor's own filings describe the work as beginning in the month of the departure, the independent-development story has to explain a compression that no one else in the sector achieved. The investigation should therefore gather the defendant-side timeline from public sources, since that is what is available before discovery: patent filings with priority dates, regulatory submissions, product launch announcements, conference talks, hiring posts, and archived versions of the competitor's website. That public timeline is often the most persuasive document in the injunction application because it is entirely outside the plaintiff's control and cannot be dismissed as self-serving.

Two doctrines are worth knowing precisely because they are often misapplied. Inevitable disclosure, the theory that a hire will inevitably use a former employer's secrets, is not codified in the Defend Trade Secrets Act and has been rejected outright by California courts, so a claim built on it alone will not travel. The inevitable-disclosure-flavoured argument that does work is evidentiary: the departure, the destination, the overlap of subject matter and the speed of the result are facts, and the inference drawn from them is for the court. Present the four facts, not the doctrine.

Deception, honeytokens and the limits of watching people

Detection is where most espionage programmes spend their ambition and least of their effort, because detection is the part that requires knowing what normal looks like. The technique with the best ratio of value to cost is the placement of unique markers: documents, pricing sheets, engineering drawings or database rows that exist only in one place, contain a unique and traceable value, and would never appear in a legitimate external document. When one of those values surfaces in a competitor's quotation, in a job posting or in a public filing, the company has not just a suspicion but an artefact, and the artefact points at the system and the account it came from.

The legal constraints on this are specific and are usually ignored. A marker is legitimate where it is created by the company, on company systems, to protect company information. It becomes something else if it is used to trap an individual into a personal relationship, to induce conduct that would not otherwise have occurred, or to collect data about a person's private life. The distinction to teach the team is that a honeytoken observes the use of the company's own asset, while an entrapment exercise manufactures the offence. Only the first belongs in a corporate programme, and only the first produces evidence a court will welcome.

Because the marker approach works only where someone takes the file, which is after the damage, the complementary control is behavioural: a baseline of download and print volume per role, alerts at a multiple of the baseline rather than at a fixed threshold, and a review process that a manager can actually run in ten minutes. Log-only programmes fail because the alerts arrive at a security team that has no authority over the individual and no context about the project. The programme works when the manager of a leaver receives a short, specific notification: this person downloaded 1,842 files in the last three weeks against a baseline of 90, and 61 per cent of them were in the project they were removed from on Tuesday. That message produces a decision. A dashboard produces nothing.

The immunity notice that decides whether you can recover fees

There is a provision in the Defend Trade Secrets Act that almost no investigation file checks and that can cost a plaintiff its exemplary damages and its attorney's fees. Under 18 U.S.C. section 1833(b) an individual is immune from liability for disclosing a trade secret in confidence to a government official or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law, or in a document filed under seal in a lawsuit. Section 1833(b)(3) requires an employer to provide notice of that immunity in any contract or agreement governing the use of trade secrets or confidential information, and it bars exemplary damages and fees in a DTSA action against an employee where the employer failed to provide it.

The practical consequence is a document review that belongs in the investigation's opening phase rather than in the damages phase: pull every agreement template in use over the past decade, in every jurisdiction, check whether the immunity language is present and whether it was present in the version the subject signed, and identify any population whose agreements lack it. The finding is usually that a template was updated at some point and the older population, which includes long-tenured employees, carries the defective version. That is a real, quantified limitation on the claim's value, and it is far better discovered by the plaintiff's own team than by the defendant's.

The same review should check the clauses that make the reasonable-measures argument work: that the definition of confidential information is specific rather than generic, that it covers the categories actually claimed, that the restrictive covenants are lawful in the relevant jurisdiction, and that the agreements were actually delivered to and signed by the individuals rather than merely referenced in an onboarding pack. Clauses that cannot be enforced are not measures, and a court assessing reasonable measures will notice the difference between a policy that was signed and one that was posted on an intranet nobody opened.

What the report must contain to survive an injunction hearing

An injunction is granted on a short document with annexes, read by a judge who has to decide whether the plaintiff is likely to succeed and whether irreparable harm is happening now. The report that supports that application has a fixed skeleton, and writing to it from the beginning saves a week at the end. The exhibit standard it has to meet is the same one that governs any digital forensics evidence used in legal proceedings.

It needs a scope statement naming every device, account, repository and time window examined, with exclusions stated and justified, because an exclusions paragraph is the difference between a thorough investigation and a story about one laptop. It needs the asset schedule: each claimed secret, its creation date, its designation, its storage, its access population and its value basis. It needs two timelines, the event timeline and the knowledge timeline, with a source cited for every entry, since the gap between them is what the three-year clock argument is built on. It needs the per-channel transfer findings with the artefacts behind each one, and a separate class of findings for what could not be established. It needs a limitations section listing what the evidence cannot show and why, because a report with no stated limitations reads as advocacy rather than analysis. And it needs the attestation: who did the work, what tools and versions, what process, what qualifications, and the hashes.

Two structural habits distinguish reports that hold up. The first is that every conclusion names its evidence in the sentence that makes it, not in a footnote three pages later; a judge reading a finding should not have to hunt for its basis. The second is that the report distinguishes the four propositions that cases actually turn on: the information was secret, the company protected it, the subject accessed it, and the information left. Each has different evidence, different weaknesses and different strength, and a report that blends them into one narrative of wrongdoing invites a defence that attacks the strongest proposition and lets the weakest hide.

Cost: the arithmetic of a case, not a day rate

Quoted day rates for forensic work vary so widely between firms, jurisdictions and urgency that a single figure is misleading, so the useful way to plan is to model the drivers. Four of them account for nearly all of the variation.

Device count and collection method is the first: imaging a laptop, a phone and a server is a different engagement from imaging an engineering team of thirty, and targeted collection, where the analyst extracts named artefact families rather than the full disk, typically costs a fraction of full imaging while producing most of the probative material. Data volume and review rate is the second: the review of documents and messages for relevance to the claimed secrets is billed by time, so the number of gigabytes that must be searched, not the number of devices, sets the bill, and the choice between keyword culls and a full review can change the cost by an order of magnitude. Jurisdiction count is the third, because each additional country adds counsel, transfer mechanics and often a separate evidentiary standard. Expert-testimony exposure is the fourth and the largest single line at trial, since deposition and hearing preparation are billed at senior rates for days at a time.

Set against those numbers, the value at stake is not hypothetical. The Silver Fern verdict of 1,916,137 dollars came out of a customer pricing folder. The Delaware Supreme Court heard argument on 28 October 2026 over a trade secret judgment of nearly 69.2 million dollars, contested on whether the formulas' recreation cost was inflated. A routine engagement that establishes the six deliverables costs a small fraction of either figure, and the engagements that cost multiples of the necessary amount are the ones commissioned without a defined question, collecting everything, producing a narrative nobody can use. The discipline that keeps cost sane is the one this article keeps returning to: decide which of the six deliverables the file needs, collect for those, and stop.

Building the programme that prevents the next file

Every investigation ends with a remediation list, and the lists are remarkably consistent across industries: classify the assets, restrict by role, instrument the exit, test the markers, and train the people who see the early signals. What separates a functioning programme from a compliance document is that each element has a count attached to it and an owner with the authority to act on the count.

Classification first, because it is the prerequisite for everything else and it is where companies substitute ambition for completion. A defensible programme does not classify everything; it designates a hundred or two hundred items that would genuinely harm the business if a competitor held them, records the designation with a date, and stores those items in a small number of controlled locations. The rest of the estate is then handled as ordinary confidential material, which is a lower standard with lower controls. The count to report is the number of designated items, the number of controlled locations, and the percentage of designated items that live in one of them - a number that starts below half in almost every first audit.

Instrumentation second. The signals that arrive before a bad exit are behavioural rather than technical: unusual hours, access to material outside the person's remit, printing in volume, a sudden interest in a project they are being moved off, contact from a competitor, unexplained travel, or a financial change. CISA's guide and the Bureau's public guidance both stress the same two things about these signals: employees have to be trained to recognise and report them, and the reporting route has to be one that does not feel like accusation. A programme whose only channel is a hotline will not hear about the colleague who has started printing drawings at ten at night; a programme where a manager can raise a concern in a system with a documented triage path will.

Third, the exit, which is the one control with a measurable return. Instrument the notice period rather than the last day: baseline each departing person's access volume, review the delta, preserve before wiping, and record the exit conversation. Companies that do this find two things quickly. Most leavers are unremarkable and can be cleared in minutes, which makes the programme cheap. And the exceptions cluster in the last three weeks, which is exactly where the evidence is still recoverable if the preserve procedure was triggered on notice rather than on the last day.

The lawful boundary and who should not run this work

The activities in this guide are lawful where the company is examining its own systems, its own accounts and its own records, on documented grounds, under a policy that was in force beforehand, with proportionality that can be explained to a regulator. They stop being lawful the moment they reach into a person's private accounts, a person's own device, or another company's systems, or where they are used to harass, to pre-empt a lawful resignation, or to gather material for a purpose unrelated to the protection of the information. An investigation that begins as a trade secret matter and becomes a hunt through someone's personal life has produced a counterclaim, a data protection complaint and, in some jurisdictions, a criminal exposure for the employer.

There is a second boundary that is about competence rather than legality. The party that built or operates the systems under examination should not be the party reporting on how those systems were used. Managed service providers, systems integrators and internal IT teams all have a structural conflict when the question is whether their own access controls, logging configuration or offboarding automation failed. Independence means no operational role in the controls being assessed and no commercial interest in the conclusion, stated plainly in the engagement letter. Where legal exposure is likely, the engagement is made through counsel so the work product can sit under privilege, which changes the reporting route and should be decided before the first artefact is collected rather than after the first report is written.

And the third boundary is the one clients least want to hear. Not every suspicion is a case. Where the information was never designated, where the access controls were absent, where the logs were never retained and where the exit was a routine wipe, the honest finding is that the evidence does not support a claim, and the money is better spent on the remediation that prevents the next one. An investigator who says so has done the job. If you are trying to work out whether you have a case before commissioning anything, talk to us first. An investigator who writes a narrative anyway has sold a story, and the story will fail in the same courtroom that reversed a 59 million dollar verdict over a date.