A trade-secret matter rarely announces itself. It begins with a resignation, an uneasy hunch, and a narrow window in which to find out — to a courtroom standard — whether protected information has actually left the building and who took it. That is the position a national retailer found itself in when one of its most senior merchandising executives walked out the door and into a competitor's.
The situation
A national omnichannel retailer had built its competitive advantage on a proprietary pricing and merchandising platform — the algorithms that set assortment and markdowns, the negotiated supplier terms behind them, and the customer data that fed them. When a senior merchandising executive with deep access to that platform resigned without notice to join a direct competitor, the retailer's leadership feared the worst: that the company's most closely guarded trade secrets were leaving with the executive.
The retailer's litigation counsel faced a narrow window and a high bar. To move for emergency injunctive relief, counsel could not rely on suspicion; they needed evidence that protected information had actually been taken, an account of how it left the environment, and a defensible answer to who was responsible — developed discreetly, before the executive or the new employer could respond, and built to survive scrutiny in court.
Our approach
Law & Forensics was engaged under attorney-client privilege through the retailer's outside litigation counsel, preserving work-product protection over the investigation. The team scoped the work as a focused trade-secret exfiltration investigation rather than a general security review, anchored from the outset to the questions a court would ask.
Forensic preservation across endpoints, email, and cloud. Working from a defensible chain of custody, the team forensically imaged and preserved the executive's company-issued devices and examined corporate and personal email, along with the cloud storage and file-synchronization accounts the executive had touched in the weeks surrounding the departure — capturing the evidence in a form that would hold up to challenge.
Exfiltration reconstruction. Through analysis of file-access and USB artifacts, cloud-upload and sync records, email and webmail activity, and operating-system and application logs, the team reconstructed how proprietary pricing and merchandising files and customer data had been gathered, copied, and routed out of the environment — and timed that activity against the executive's resignation and the move to the competitor.
Attribution. Rather than stop at "data left," Law & Forensics correlated the artifacts — account credentials, device identifiers, session and login records, and behavioral patterns — to tie the exfiltration to the departing executive personally, distinguishing deliberate removal from ordinary business use and closing off competing explanations.
Evidence packaged for the courtroom. The team produced a privileged forensic findings report and an exhibit-ready evidence package, preserved in forensically sound form, structured so that the reconstruction and attribution could be presented clearly to the court and defended on cross-examination.
The impact
The forensic reconstruction and attribution gave the retailer's counsel the evidentiary foundation they needed to seek emergency injunctive relief and to pursue trade-secret litigation against the departing executive and the competitor. A Law & Forensics testifying expert presented the findings, explaining in plain terms how the proprietary information had been taken and why the evidence pointed to the executive — testimony that held up under cross-examination. With a clear forensic record of what had left, where it had gone, and who was responsible, the retailer was positioned to protect the algorithms and customer data at the heart of its business and to hold the responsible parties accountable.
