A departing team and trade secrets case
A worked departing employee and trade secrets matter: imaging, USB and cloud exfiltration analysis, evidence for an injunction, with a week by week timeline, indicative costs and the questions litigators ask.
Three members of a sales team resign together to join a competitor. Two weeks before leaving, one of them connected an external drive to a company laptop and downloaded the client pricing model from SharePoint. The client wants evidence good enough to support a springboard injunction, quickly.
This page sets out what happens at each stage, what it costs and the questions counsel ask before instructing. The figures are indicative and exclude VAT.
§ Timeline
What happens, and when
- Day 1
Secure the devices and accounts
Quarantine the returned laptops without booting them, suspend the leavers' accounts rather than deleting them, and preserve the tenant audit logs before the retention window closes.
- Day 1 to 3
Forensic imaging
Full disk images of the laptops and a tenant side export of the mailboxes and SharePoint activity, all hashed and logged so the evidence stands up if it is challenged.
- Day 3 to 7
Exfiltration analysis
USB device history, link file and shellbag analysis, cloud sync artefacts, webmail uploads and print history, mapped to a timeline of who touched what and when.
- Week 2
Evidence for the application
A short factual report with exhibits, suitable to go behind a witness statement in support of a springboard or delivery up application, plus the preservation record.
- Week 3 onwards
Imaging under an order
If an order is made, we image the personal devices and accounts covered by it, apply the search protocol and report to the court appointed supervising solicitor.
- Ongoing
Remediation and verification
Verified deletion of the material from the recipient's systems, with a statement confirming what was found, what was removed and what remains.
§ Costs
What each stage costs
Indicative ranges for a matter of this shape, excluding VAT, court fees and your own review time. Every instruction gets a written stage by stage budget after the first call, and we do not move to the next stage without approval.
| Stage | Indicative fee | What it covers |
|---|---|---|
| Preservation and imaging | £450 to £850 per device | Forensic image, hash verification and evidence log. |
| Cloud and tenant preservation | £800 to £2,000 | Mailbox, SharePoint and audit log export for the leavers. |
| Exfiltration analysis | £2,500 to £6,000 | USB, cloud sync, webmail and print artefacts with a timeline of activity. |
| Report for the application | £1,500 to £4,000 | Factual report with exhibits, drafted for use in a witness statement. |
| Imaging under an order | £1,200 to £3,500 | Personal devices and accounts, search protocol and supervising solicitor liaison. |
| Expert evidence | £3,000 to £8,000 | Part 35 compliant report and hearing attendance if the analysis is challenged. |
§ FAQs
Questions counsel ask
- How fast can we get evidence for an injunction?
- A first indication of USB and cloud activity is usually available within 48 hours of receiving the laptop, and an exhibited report within a week. Speed depends on getting the devices untouched and the tenant logs before they age out.
- The laptop was wiped and reissued. Is it too late?
- Often not. Reimaging leaves recoverable artefacts, and the tenant side records of downloads, shares and sign-ins usually survive independently of the device. Tell us early so we can freeze the logs.
- Can you analyse a personal device?
- Only with consent or under a court order. Where an order is made we work to its search protocol and report through the supervising solicitor, keeping irrelevant personal material out of the process.
- What does this cost?
- A three leaver matter through to an exhibited report usually runs between £8,000 and £18,000, driven mostly by the number of devices and whether an order follows. You get a written budget before we start.
Technology and IP disputes →Preservation →Collection →
§ From the Case Builder blog
- Collecting mobile and chat evidence defensibly
Phones, Teams and WhatsApp carry the decisive messages. Here is how to collect them so the other side cannot attack the method.
- What a judge expects from a disclosure witness statement
The statement supporting your search, collection and review decisions is the document that gets tested. Write it for the court, not for the file.
- The first 72 hours of a departing team case
Trade secrets and team move matters are decided by what is preserved before anyone is confronted. A practical order of work.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.