Trade secret litigation: what the forensic record can and cannot show

What is actually in dispute

A misappropriation claim needs the thing to have been a secret, to have been protected, and to have been acquired, used or disclosed improperly — and only the last of those is a question a forensic examiner can address.

That division matters. Whether the material qualifies as a trade secret, whether the protective measures were reasonable, and whether a covenant is enforceable are questions for the court and for counsel. What an examiner contributes is a reconstruction of conduct: which accounts touched which files, which devices were attached, what was uploaded or mailed out, and when.

These matters also run on an unusual clock. Many are filed with a motion for a temporary restraining order attached, so a declaration is needed in days rather than the months a Rule 26 schedule allows. Acquisition happens before the search protocol is settled, findings are stated on a partial record, and the report that follows months later has to be consistent with the declaration that went first. Saying less, earlier, is what makes that possible.

The four routes out

Almost every departing-employee data question resolves into one of four transfer routes, and each leaves a different record:

• Removable media. A USB drive or external disk attached to the machine. Recorded in the SYSTEM and SOFTWARE registry hives, in shortcut files that embed the volume serial number of the media, and in shellbags recording folders browsed on the volume.
• Personal cloud storage. A consumer OneDrive, Google Drive, Dropbox or Box account signed in on a company machine. The sync client writes local databases naming folders, files and sync events, and the enterprise tenant keeps its own audit trail.
• Webmail and messaging. Files attached to messages sent from a personal account, or forwarded from the corporate mailbox. The corporate side is usually the strongest record available, because mail systems log delivery rather than inferring it.
• Print, photograph and screen capture. The route that leaves the least, and is therefore the one most often overstated. Print spooler records can show a document was sent to a printer; a photograph of a screen taken on a phone leaves nothing at all on the machine.

Where the material taken is software rather than documents, the device examination establishes the route and source code review establishes what was actually copied. The two are normally run together, because neither answers the other’s question — and a matter that arrives as a trade secret claim over code frequently becomes a patent or ITC proceeding as well.

Which artifacts bear on it

The evidentiary centre of gravity in a trade secret matter is removable-media history, sync-client records, and timing. Those three do most of the work; everything else corroborates or contradicts them.

Device attachment

The USBSTOR subkey of the SYSTEM hive records the vendor, product and serial number of USB storage devices that have been attached, and related keys record when a device was first and last connected and which account mounted it. That is a specific finding: this device, this machine, this window. It is also the artifact most often asked to carry an inference it cannot support, because attachment is not transfer.

Folder and file interaction

Shellbags record that a folder was browsed through the shell, including folders on media that is no longer present. Shortcut files and jump lists record that a path was opened, and shortcuts carry the volume serial number of the device the target lived on — which is how a document opened from a specific external disk is tied back to that disk. The master file table and change journal record creations, renames and deletions at file level, and a discrepancy between the two sets of timestamps NTFS keeps is the classic signature of timestamp manipulation.

Volume, and what left the machine

SRUM, the system resource usage monitor, records bytes sent and received per application per user in hourly buckets, and is often the only local record bearing on how much data left a machine. It is a quantity, not a manifest: it can show a sync client moving several gigabytes on the Saturday before a resignation, and it cannot say what was in them.

Earlier states of the same disk

Volume shadow copies frequently hold a version of a document, a registry hive or a sync database from before it was altered or deleted, which is what makes them worth the acquisition time in a matter where someone had notice and a weekend.

The tool at can this artifact prove that? maps a proposition onto the records that bear on it and shows where the inference runs out — better done before a complaint is drafted than after a deposition.

The expert’s role and the deliverable

1. 01Preservation, immediately. Before scope, before search terms, before anyone argues about protocol. The laptop, any device already returned, the mailbox, and the tenant audit log. The preservation deadline calculator exists for this step.
2. 02Acquisition under write-block. Devices imaged to E01 or raw, hashed at acquisition and again at verification, with a custody form that becomes an exhibit. Where a machine cannot leave service, the alternative and its cost are recorded rather than glossed.
3. 03Targeted analysis against the question. Device history, sync artifacts, mail, and a timeline built around the resignation date. On an injunction schedule this is deliberately narrow: a defensible declaration in days, not a complete reconstruction in months.
4. 04Declaration. A sworn statement under 28 U.S.C. § 1746 or a state-law affidavit, stating what was examined, what was found, and — the part that carries weight later — what has not yet been examined and what that limits.
5. 05The Rule 26(a)(2)(B) report, in due course. Complete opinions with basis and reasons, facts and data considered, exhibits, qualifications, a four-year testimony list, and compensation. Findings that cut against the retaining party are recorded the same way as the rest; an examiner who reports only helpful results is not offering an opinion.
6. 06Rebuttal and testimony. Often the real work: testing the other examiner’s method against the same image, and either reproducing their result or saying precisely where it fails.

How the report is scoped, disclosed and defended is set out on the expert witness testimony page, and the underlying examination on the computer forensics page.

Where Rule 702 pressure falls here

Under Rule 702 as amended on December 1, 2023, the proponent must show it is more likely than not that the opinion reflects a reliable application of the method to the facts of the case. Here the challenge almost never attacks imaging or hashing. It attacks the distance between what the artifacts record and what the expert said they showed.

• The copy inference stated as observation. An opinion that attachment plus a folder listing equals a copy is the most exposed sentence in this matter type. The fix is not softer language; it is stating the route, the timing, and what would corroborate the transfer.
• Timeline reliability. A timestamp records what one source wrote, subject to time zone, clock drift, and filesystem-versus-application semantics. A timeline that has not been normalised and corroborated across sources is what an opposing expert takes apart first.
• Scope of the collection. If the personal device was never sought, or the tenant log was not preserved in time, opposing counsel will argue the opinion rests on whatever fraction of the record happened to survive. Disclosing the gap is not a weakness; discovering it on cross is.
• Opinions on secrecy, value or enforceability. Whether the material was a trade secret, and whether protection was reasonable, are not forensic findings. An expert who opines on them has a Rule 702 problem whatever the answer.
• Tool output offered without method. A parsed registry export is data. The opinion is the reasoning that connects it to the question, and a report showing the first without the second invites the argument that no method was applied to the facts of the case.

The Daubert Docket collects rulings on digital forensic testimony, including the exclusions that turned on exactly this overreach; the Daubert exposure check walks an opinion against the same failure modes before it is served, and the guide to Daubert challenges to digital evidence sets out the framework.

Questions counsel ask

Related reading

• Employment and departing employees

  The same departure, read for access and attribution rather than for exfiltration — and the account-versus-person problem in full.

• Computer forensics

  Write-blocked acquisition, the artifacts an operating system keeps, and the three distinctions that keep an opinion inside what the evidence supports.

• Cloud forensics

  Where the exfiltration route was a tenant rather than a device — audit logs, retention windows, and API-only collection.

• Daubert challenges to digital evidence

  Rule 702 as amended in December 2023, the reliability factors, and the ways forensic opinions actually get excluded.