A departing team and trade secrets case
A worked departing employee and trade secrets matter: imaging, USB and cloud exfiltration analysis, evidence for an injunction, with a week by week timeline, what shapes the cost and the questions litigators ask.
Three members of a sales team resign together to join a competitor. Two weeks before leaving, one of them connected an external drive to a company laptop and downloaded the client pricing model from SharePoint. The client wants evidence good enough to support a springboard injunction, quickly.
This page sets out what happens at each stage and the questions counsel ask before instructing. Fees are assessed case by case and quoted in writing.
§ Timeline
What happens, and when
- Day 1
Secure the devices and accounts
Quarantine the returned laptops without booting them, suspend the leavers' accounts rather than deleting them, and preserve the tenant audit logs before the retention window closes.
- Day 1 to 3
Forensic imaging
Full disk images of the laptops and a tenant side export of the mailboxes and SharePoint activity, all hashed and logged so the evidence stands up if it is challenged.
- Day 3 to 7
Exfiltration analysis
USB device history, link file and shellbag analysis, cloud sync artefacts, webmail uploads and print history, mapped to a timeline of who touched what and when.
- Week 2
Evidence for the application
A short factual report with exhibits, suitable to go behind a witness statement in support of a springboard or delivery up application, plus the preservation record.
- Week 3 onwards
Imaging under an order
If an order is made, we image the personal devices and accounts covered by it, apply the search protocol and report to the court appointed supervising solicitor.
- Ongoing
Remediation and verification
Verified deletion of the material from the recipient's systems, with a statement confirming what was found, what was removed and what remains.
§ Fees
What each stage covers
We do not publish rates. Every matter is assessed and quoted individually, because scope, data volume and urgency differ in every case. After the first call you get a written stage by stage quotation, and we do not move to the next stage without your approval.
| Stage | What it covers |
|---|---|
| Preservation and imaging | Forensic image, hash verification and evidence log. |
| Cloud and tenant preservation | Mailbox, SharePoint and audit log export for the leavers. |
| Exfiltration analysis | USB, cloud sync, webmail and print artefacts with a timeline of activity. |
| Report for the application | Factual report with exhibits, drafted for use in a witness statement. |
| Imaging under an order | Personal devices and accounts, search protocol and supervising solicitor liaison. |
| Expert evidence | Part 35 compliant report and hearing attendance if the analysis is challenged. |
§ FAQs
Questions counsel ask
- How fast can we get evidence for an injunction?
- A first indication of USB and cloud activity is usually available within 48 hours of receiving the laptop, and an exhibited report within a week. Speed depends on getting the devices untouched and the tenant logs before they age out.
- The laptop was wiped and reissued. Is it too late?
- Often not. Reimaging leaves recoverable artefacts, and the tenant side records of downloads, shares and sign-ins usually survive independently of the device. Tell us early so we can freeze the logs.
- Can you analyse a personal device?
- Only with consent or under a court order. Where an order is made we work to its search protocol and report through the supervising solicitor, keeping irrelevant personal material out of the process.
- What does this cost?
- There is no standard price. It depends on how many devices and accounts are imaged, whether an order follows and how far the analysis has to go. We agree a written scope and quotation before any work starts.
Technology and IP disputes →Preservation →Collection →
§ From the Case Builder blog
- Collecting mobile and chat evidence defensibly
Phones, Teams and WhatsApp carry the decisive messages. Here is how to collect them so the other side cannot attack the method.
- What a judge expects from a disclosure witness statement
The statement supporting your search, collection and review decisions is the document that gets tested. Write it for the court, not for the file.
- The first 72 hours of a departing team case
Trade secrets and team move matters are decided by what is preserved before anyone is confronted. A practical order of work.
Bring us in early.
Defensibility is built, not retrofitted.
Whether you are responding to a regulator, preparing for disclosure, or scoping an internal investigation, start the chain of custody with a short, confidential conversation.