SCENARIO
The Sales Director of a large multinational manufacturing company suspected a former employee exfiltrating confidential data. The company learned that this former employee began working for a competing company by way of email communications and other indicators.
The original company became suspicious of the activity and contacted their attorney. Through negotiations both defendant and plaintiff attorneys came to an agreement to use a single digital forensics company. Guardian Forensics was hired to be the independent digital forensics company and conduct the forensic preservation and analysis. Several items that included iPhones, laptops, multiple USB devices, and email accounts were turned over to Guardian. The assignment and scope of work was provided that included searching all digital evidence with numerous keywords with specific date range filters using eDiscovery protocols, and determine how and to what extent the company confidential data in the form of marketing and product information had been transferred to unauthorized entities.
CHALLENGE
The forensic investigation of identifying the modus operandi of exfiltrating data from a corporation can be tough challenge. There are now numerous technology methods of transferring information from emails, USB devices, to use of Cloud storage accounts. This challenge is even more complex depending on the level of technical skills and security privileges of the suspected employee. Insider threats and data theft are among one of the most costly forms of intellectual property theft that can go undetected.
As egregious as the former employee’s actions where perceived, it was Guardian’s task to determine if the employee had actually been truthful to the extent of the data he removed in his separation of employment and moving on the competitor. The defendant’s attorney was was skeptical of their chances of understanding the full extent of how much of their data was stolen, as the company did not have a Non-Competition Agreement in-place with the former employee. However, as they started learning more about the activities that transpired prior to the individual leaving their employment, things started looking better for the company as there were indications that this was more than just the run-of-the-mill Intellectual Property Theft.
A large part of that change in tide for the company was due to the results of Guardian digital forensics analysis of the former employee’s electronic devices – a laptop, email accounts, and USB devices. As there was initially no suspicion of any wrong-doing when the sales director resigned, those devices were redeployed within the environment. Upon discovering that the company was now in competition with this former employee, they immediately seized the devices and placed them in secure storage.
SOLUTION
Through Guardian Forensics professional services the analysis revealed very interesting facts. The relevant artifacts showed the former sales director used a personal USB storage device and a secondary iPhone to exfiltrate confidential data over the last 5 months of employments. A total of 16GB of data was identified through the Link Analysis and USB forensics that pinpointed the exact data that was transferred. The forensic analysis revealed that the former employee had copied and accessed sensitive, confidential information from external media – such as proprietary product lists, supplier lists, technical data sheets, pictures, databases and spreadsheets all containing sensitive, proprietary information on the dates leading up to and on the days the data was backed up to USB device. In this IP theft case, it is important to note that neither the manufacturing company nor Guardian Investigations had access to the personal external media or secondary cell phone. Guardian expertise in identifying and analyzing relevant artifacts provided the trace evidence needed to crack the intellectual property theft case and provide the ammo needed for additional discovery.
Guardian Forensics experience in digital forensics and technology type investigations, allowed the company to fully understand the activities and the impact that those activities had for the intellectual property.
RESULT
The manufacturing company and their attorneys obtained enough evidence with the use of Guardian to seek recovery of damages and restraining order on the use of their stolen data. The end result — Guardian proved itself as a valuable corporate investigate resource to Unlocking the Truth.