Case Study
Rapid Forensic Analysis Across 80 Devices and Cloud Sources Provides Critical Insight During Contentious Intellectual Property Case
When an intellectual property dispute between two companies in the aviation industry escalated to litigation and potential criminal charges, the defendant organization needed to quickly understand whether there was any merit underlying the allegations in the suit. This necessitated expedited forensic analysis of many dozens of devices in addition to cloud searches and other discovery work relative to the litigation. FTI Technology was engaged to provide digital forensics and emerging data sources expertise and support.
Situation
The client had hired numerous senior level engineers from another company in the same industry, which spurred accusations that the engineers had taken IP, including documents, development materials and other sensitive information from their former employer upon departing. The ensuing litigation required the client to review the materials and activities of the employees in question and determine whether anything that qualified as IP was brought over from the competitor, and if so, whether it was used in any meaningful way.
Speed was a pressing requirement in the response to this matter, as the client was in the midst of important investor cycles when the suit was filed. In addition to conducting early case assessment and discovery for the litigation, counsel needed to provide key facts about any usage of the IP to stakeholders and investors within weeks. The CEO was confident that there was no actual wrongdoing and needed FTI Technology to analyze the evidence to quickly confirm that for investors.
Initially, FTI Technology was engaged to provide forensic analysis of 80 devices and cloud- based sources, including Google Workspace, Slack, Jira and Bitbucket, and to issue a report of findings to the client within one month’s time. The devices included both company and personal computers and mobile phones. Because the employees had been instructed to delete any data from personal devices prior to departing the former employer, it was critical that the analysis included a close examination of forensic artifacts and records that could demonstrate when files had been accessed, copied, downloaded, shared, changed or deleted.
The nature of the case meant that finding any artifact or record of user activity on a device indicating that sensitive files may have been accessed after the departure date was as significant as having the document itself still on the device. Each item had potential bearing on the outcome. In addition, any activity indicating uploads of data to the company’s cloud-based systems required forensic analysis to ensure there was no inappropriate usage of the data. As a result, counsel demanded that FTI Technology’s analysis be extremely rigorous in regard to every granular detail, and the defensibility of every step in the analysis needed to be assured.
As the case progressed, it became clear that the other provider involved in the e-discovery portion of the project did not have the emerging data sources expertise and capability that FTI Technology possessed. Missteps by the other provider in handling certain data led to loss of pertinent information. Throughout the engagement, counsel was increasingly dependent upon FTI Technology’s deep expertise with respect to cloud data sources.
Our Role
FTI Technology’s Digital Forensics and Emerging Data Sources team members conducted employee interviews with key custodians and consulted directly with counsel and with the client’s senior leadership team to help guide the investigation and the development of a response plan. FTI Technology leveraged sophisticated analytical tools as well as its own deep forensic and investigative experience with such matters to bring clarity to counsel, the client and other stakeholders. A declaration detailing the findings from the cloud-based sources and from the devices was provided to the client and its investors within the first few months of the engagement. This included FTI Technology’s experts presenting findings, including the results of exhaustive analysis of user activity in Google Workspace, Slack and Bitbucket, directly to the stakeholders to explain that the evidence found validated the CEO’s assertions that the company and the engineers in question had not stolen and/ or meaningfully used any of the competitor’s IP.
Through interviews with the employees at the center of the dispute and discussions with counsel, FTI Technology’s team supported counsel in uncovering additional physical devices (including backup devices and external USB thumb drives and hard drives) and cloud based data sources that needed to be included in the scope of analysis in order to completely and defensibly disprove the allegations. Additionally, the case required close attention to key dates and metadata to distinguish between activity on personal devices before the engineers departed their previous employer and after they had started at the client organization. The team was thorough in ensuring a comprehensive and forensically sound exercise to support the client with reassuring its stakeholders and responding to the litigation.
FTI Technology’s teams collaboratively supported the ongoing matter over the course of two years, efficiently working with other service providers to obtain information and to advise on search methodologies. Continuous support also included advising the client on findings, verifying the defensibility of the processes used across each phase of the forensic analysis and e-discovery efforts by all parties, and testifying to the results via depositions and court filings.
Our Impact
In an intense, high pressure, high profile, highly scrutinized matter involving new and complex data platforms, FTI Technology was able to bring unparalleled technical skill and investigative experience. This included scaling a team to support the complexities, technical nuances and timelines of the case through expertise, as well as existing technical infrastructure to support the requirements of the matter.
FTI Technology thoroughly analyzed key facts, the available supporting evidence and provided effective expert testimony, which ultimately allowed for a novel last-minute settlement agreement based on facts.