Intellectual property theft leaves a trail

Intellectual-property and trade-secret theft is rarely a clean break. Client lists, designs, source code and pricing don't vanish — they are copied, synced or forwarded, usually in the days around a resignation. Each of those actions tends to leave a record, and that record is where a case is built.

The trail is rarely invisible

Devices and accounts log far more than people assume. USB storage leaves connection history. Cloud and personal-email uploads leave sync and send records. A sudden burst of file access or copying, often outside normal hours, stands out against a year of routine activity. Individually these are data points; assembled into a timeline, they can show what was taken, when, and how.

Preserve before it ages out

The window closes quickly. Logs roll over, devices get reissued and wiped, and accounts are deactivated — often destroying the best evidence in the ordinary course of IT housekeeping. Preserving the right sources early, before any application is served, is what keeps the trail intact.

• Preserve the departing employee's laptop, phone and account access before the device is reissued or wiped.
• Capture USB connection history, cloud-sync records and email-forwarding activity.
• Build the timeline: what was accessed, copied or sent — and exactly when.
• Engage forensics before serving an application; preservation comes first.

From artefact to admissible

Scattered artefacts only become evidence when they are collected defensibly and assembled into a clear, independent expert report — one that separates what was found from what it means. Where destruction is a real risk, this work pairs naturally with a search order to preserve the material first, then prove it later.

If you suspect IP has left with someone, the first hours matter most. An early conversation often clarifies quickly what can still be preserved — and what may already be slipping away.