A national electric utility grew concerned in the days after a senior engineer resigned to join a competing venture in the same space. The engineer had spent years working on proprietary grid topology, control-system design documents, and engineering data that represented some of the utility's most sensitive operational intellectual property. Internal indicators suggested he had not left empty-handed, but the utility lacked the forensic foundation it needed to act. Outside counsel engaged Law & Forensics to investigate under privilege and to determine, with evidentiary rigor, what had actually left the enterprise.
The Situation
Trade-secret loss in the electric-utility sector carries a distinctive weight. Grid and control-system design data is not only commercially valuable; it reflects how critical infrastructure is engineered and operated, and its disclosure to a competitor or to an unvetted third party raises concerns that extend well beyond ordinary business harm. The utility needed to move quickly, but it could not act on suspicion alone — any request for emergency relief would have to rest on a forensic record capable of withstanding scrutiny from opposing counsel and the court.
The central questions were ones of scope and attribution. The utility needed to know which repositories the engineer had reached into, what had been copied to devices and accounts outside the enterprise perimeter, and whether the activity could be tied to deliberate appropriation rather than to the routine work of a departing employee with legitimate access.
Our Approach
Law & Forensics built the investigation around a disciplined reconstruction of the engineer's data activity, drawing on the artifacts that endure across endpoints, removable media, and cloud services.
Endpoint and Removable-Media Forensics. The team forensically preserved the engineer's assigned workstation and laptop and examined the artifacts that record how data moves — USB connection and device-enrollment records, file-system and link-file metadata, shadow copies, and application logs. This work surfaced a pattern of staged collection and copying of the specific engineering files at issue, distinct from his ordinary access, and tied the connected removable devices to the user and to the moments the data was taken.
Cloud and External-Account Tracing. Law & Forensics analyzed the engineer's cloud accounts and correlated enterprise activity with synchronization and upload artifacts to follow the data beyond the company's perimeter. By reconciling the endpoint findings with the cloud record, the team established where the proprietary materials had gone and reduced the gaps that an opposing expert would otherwise probe.
Attribution and Expert Reporting. Throughout, the firm framed its findings for a courtroom rather than an internal memo. A named, court-tested testifying expert documented the methodology and conclusions so they could be explained plainly, defended on cross-examination, and relied upon in support of the relief the utility intended to seek.
The Impact
The forensic record assembled by Law & Forensics established a coherent account of how proprietary grid and control-system engineering data had been staged, copied to removable media, and moved into cloud accounts the engineer controlled. The firm's testifying expert presented that analysis in support of the utility's request for injunctive relief, and the court entered an order restraining further use and distribution of the materials.
With the evidence in hand and an order in place, the matter resolved on terms favorable to the utility, including the confirmed return and destruction of the proprietary materials and assurances against their further use. Because the forensic work had been structured for the courtroom from the outset, the utility was positioned to protect its most sensitive engineering data rather than to litigate over what had happened.
Related Practice Area
Digital Forensics Services — Trade Secret and IP Investigations; Insider Threat and Employee Misconduct; Expert Testimony for Litigation
