USB Device Evidence in Intellectual Property Investigations

When confidential information or trade secrets are compromised, digital evidence from USB devices often proves decisive. These small, portable storage units are commonly used for data transfer, making them a frequent vector for intellectual property theft. Understanding how to forensically identify, preserve, collect, and analyse this evidence is critical for any successful IP investigation or dispute in the UK.

This note outlines the practical steps for handling USB device evidence. It focuses on the specific challenges and opportunities presented by these devices in the context of intellectual property litigation and regulatory investigations, ensuring compliance with UK legal frameworks like PD 57AD and the UK GDPR.

The Critical Role of USB Devices in IP Theft

USB devices, including memory sticks, external hard drives, and even mobile phones used as storage, present a significant risk for intellectual property compromise. Their portability and ease of use mean employees can quickly copy vast amounts of data. This data often includes sensitive source code, client lists, product designs, or strategic business plans.

Investigations into trade secret misappropriation, employee departure, or licence breaches frequently reveal USB device activity. A forensic examination can establish when data was copied, what was copied, and in some cases, where it was copied from. This evidence can form the cornerstone of a legal claim, demonstrating intent and establishing the scope of data exfiltration.

Identifying Potential USB Activity

Before any collection, the first step is to identify potential sources. This involves interviews with key personnel and reviewing system logs. Consider the 'who, what, when, where, why' of the alleged data breach. This initial intelligence guides the forensic process. Focus on individuals who had access to the intellectual property and who may have had a motive to remove it. Departed employees or those moving to a competitor are prime suspects.

Preservation and Collection: Ensuring Evidentiary Integrity

The integrity of USB device evidence is paramount. Any misstep in preservation or collection can render the evidence inadmissible or diminish its weight in court. The principles outlined in the ACPO Guide for Computer-Based Electronic Evidence (now superseded by the NPCC guide) remain a foundational reference in the UK. They stress that no action should change data held on a device, and where changes are unavoidable, they must be recorded.

Initial Steps for USB Devices

• Cease Use: Immediately instruct the suspect individual to stop using any potentially compromised device. This prevents overwriting or destruction of crucial data.
• Image Acquisition: A forensic image of the USB device must be created. This is a bit-for-bit copy, an exact duplicate of the storage media. This process uses write-blocking hardware to prevent any modification to the original device.
• Chain of Custody: Maintain a meticulous chain of custody record. Document who handled the device, when, and for what purpose. This record is vital for proving the authenticity and integrity of the evidence in court.
• System Imaging: Consider imaging the computers or systems that the USB device was connected to. This provides valuable contextual data, such as connection logs and file access records.

These steps align with PD 57AD requirements for proportionality and ensuring that electronic documents are preserved without alteration. Failure to follow proper procedures can lead to costly delays or exclusion of evidence.

Forensic Analysis Techniques for USB Evidence

Once forensically acquired, the data on the USB device and associated systems can be analysed. This goes beyond simply looking for files; it involves deep-level examination to uncover hidden activities and artefacts.

• File System Analysis: Examine the file system to identify creation, modification, and access times of files. Even if a file is deleted, forensic tools can often recover it or identify fragments.
• Registry Analysis: Windows Registry entries (e.g., USBSTOR keys) record when USB devices were connected to a computer. This can establish a timeline of device usage, including its first and last connection, and provide details about the device itself.
• Link File Analysis (.lnk files): These shortcuts are created when a user accesses a file from a network share or removable device. They can reveal which files were accessed from a USB drive, even if the original files are no longer present on the computer or the USB device.
• Shellbag Analysis: Shellbags are another Windows artefact that records user activity, including folders accessed on removable media. They can provide evidence of browsing activity and the existence of specific directories.
• Recycle Bin Analysis: Examine the Recycle Bin for files deleted from the USB device while it was connected, or files moved from the host computer to the device.
• Metadata Examination: File metadata (e.g., author, last saved by, company) can link documents to specific individuals or reveal their provenance. This is particularly useful in disputes involving original designs or source code.

The output of this analysis provides concrete evidence of data transfer, access, and potential exfiltration. This often allows investigators to reconstruct events with a high degree of certainty.

Integrating USB Evidence into the eDiscovery Workflow

USB device evidence is not isolated; it must be seamlessly integrated into the broader eDiscovery workflow. This ensures that it contributes effectively to the overall disclosure process under CPR Part 31 and PD 57AD.

• Identification: As discussed, identify potential devices and host systems. This forms part of the overall scope of electronically stored information (ESI).
• Preservation: Implement legal holds and forensic imaging to prevent spoliation. Document all steps in the preservation process.
• Collection: Securely collect forensic images of devices and relevant host systems. Ensure chain of custody is maintained.
• Processing: Ingest the forensically acquired data into an eDiscovery platform. This often involves de-duplication, filtering by date or custodian, and converting proprietary formats for review.
• Review: Conduct a thorough review of the collected data. This can involve keyword searches, conceptual analytics, and technology assisted review (TAR) to identify relevant documents related to the intellectual property. Pay close attention to file types commonly associated with IP - source code files, CAD designs, proprietary documents.
• Analysis: Beyond simple review, this phase involves linking USB activity with other data sources, such as email communications or network logs. This provides a comprehensive picture of data movement and intent.
• Disclosure/Production: Prepare a Disclosure Review Document (DRD) that accurately reflects the scope and nature of the USB evidence. Produce relevant documents in an agreed format, ensuring compliance with UK GDPR if personal data is involved.

Treating USB evidence as a distinct, yet interconnected, part of the eDiscovery process prevents omissions and strengthens the overall legal position.

Practical Steps for Solicitors and In-House Counsel

Proactive measures and swift action are crucial when intellectual property theft via USB devices is suspected. Here are concrete steps to take:

1. Initial Assessment: As soon as an IP breach is suspected, conduct a rapid, confidential assessment. Identify key individuals, likely data types, and potential methods of exfiltration.
2. Legal Hold: Immediately issue a formal legal hold notice to all relevant employees. This instructs them to preserve all potentially relevant ESI, including personal devices if there is a reasonable suspicion of their use.
3. Engage Forensic Experts: Do not attempt DIY forensics. Instruct an experienced UK digital forensics practitioner immediately. They have the tools and expertise to properly acquire and analyse data without compromising integrity.
4. Image All Relevant Systems: This includes laptops, desktops, and any servers or network shares known to contain the intellectual property. Ensure any USB devices identified are also imaged.
5. Interview Key Personnel: Conduct interviews with individuals who had access to the IP and those suspected of its removal. Their statements can guide forensic efforts, but remember to record these carefully.
6. Review HR Records: Examine employment contracts, confidentiality agreements, and IT policies. These provide context for employee obligations and potential breaches.
7. Monitor for Post-Departure Activity: If the suspect is a former employee, monitor publicly available information, new employers, and online activity that might indicate misuse of the IP.
8. Prepare for Disclosure: As evidence emerges, begin preparing for the disclosure process. Categorise documents, assess privilege, and be ready to articulate the forensic findings clearly.

Timely intervention and expert handling of USB device evidence can significantly enhance the prospects of successfully recovering intellectual property or securing an injunction and damages.