A large manufacturing company became suspicious that one of its former sales staff had been stealing the company's intellectual property, after noticing a drop in sales following his departure.

The employee in question had left the company several months ago and made no secret among his workmates that he was planning to start work at a rival organisation.  The subsequent lack of business led his former bosses to suspect that he had stolen their customer database for use at his new company. 

CCL-Forensics was engaged by the company's legal team to investigate the former employee's workstation and found that a removable hard drive had been used to remove data from the server on the day he left the company.

This new information meant that the courts were then able to order the former employee's home computer be seized.  An examination of this machine then revealed that the database had indeed been copied from an external hard drive and viewed on a number of occasions. 

During this examination, a number of further incriminating files were recovered from the hard drive of the suspect's home computer, including emails to his prospective new boss giving details of his plans to boost sales at his new company. 

Throughout this period, both CCL's Account Manager and the analyst working on the case remained on-call and worked evenings and weekends to ensure that the demands of the court were met.

The case was taken to the civil courts, with the suspect being charged with theft of intellectual property.