Copied, Transferred or Only Reachable: The Records Decide

A data exfiltration allegation should be broken into separate questions about access, copying, transfer and attribution, because the evidence for each lives in a different place and the opposing expert will attack whichever one is weakest. We identify the files or data at issue and the disputed period first, then assess whether the available records support a transfer or only an opportunity to make one. You receive the supported technical account and every record behind it.

Global Digital Forensics has operated since 1992. Our examiners have testified in federal and state courts, and the firm has served AmLaw 100 firms and Fortune 1000 companies. In a data theft case the fate of a trade secret can rest on what a laptop, a mailbox and a cloud audit log can be shown to say, and that is work for examiners who have defended their findings under oath. Robert Knudsen brings eighteen years of forensic experience and hundreds of computer and mobile device examinations supporting federal and state court matters. Veronica Perez has been designated as a digital forensics expert witness in California, Oklahoma and South Carolina state courts and in federal court in Chicago, and her casework includes intellectual property theft and trade secret disputes.

If the allegation in your matter has not yet been broken into those four questions, send us the complaint’s description of the transfer and we will say which records could test each one.

Information leaves an organization by a limited number of routes: removable media, email attachments, cloud sharing, synchronization clients, downloads and network transfers. We follow each of them through the endpoint records, audit events, permissions and retained security telemetry that your environment actually kept, selecting the evidence for each path rather than assuming the same artifact answers every question.

In the worldwide intellectual property matter described in our case studies, two employees and a manager who left a large chemical manufacturer emailed a customer contact database, invoicing information and proprietary data to their home computers and deleted the messages, believing that made them untraceable. We identified the mail servers that received the information, several sets of backup tapes and the database itself, forensically examined the former employees' desktops, extracted the original emails and correlated dates, times and related records so counsel could assess both the transfer and the receiving company's knowledge of it.

Which routes still hold evidence depends on retention that is running now. Call (800) 868-8189 and we will name the sources to preserve first.

We distinguish what an account could access, what the records show it did access and what evidence supports an actual transfer. A transfer event then raises its own questions about the content that moved, who controls the destination and which person was at the keyboard, and the opinion answers each one from its own records, because an expert who overstates the record hands the other side its cross examination.

Matching content is proved with hash values and file comparison rather than file names, and where the evidence supports a comparison of specific files the report explains the basis for each match. The examination also accounts for how each record was collected, because a cloud audit log and a USB registry artifact were built for different purposes and answer different questions.

Counsel preparing to depose the opposing expert can ask us which of their inferences rest on opportunity alone; the initial consultation is free.

The report includes a timeline linked to the original records, the competing explanations we tested and the exhibits that support each conclusion, so the evidence arrives in a form the other side's expert can check and the court can follow.

A sound timeline distinguishes possession of access rights, recorded file activity and evidence of movement to another destination, which shows exactly which parts of the allegation have direct support. Where the records connect an action to a particular person, the timeline shows exactly which records make that connection.

Before the report is drafted, read the common digital evidence mistakes guide to see the gaps an opposing expert looks for first.

A USB connection, a cloud login or a large network transfer is enough to prompt an examination, but none of them identifies the files or the person involved by itself. We compare file activity, device artifacts, application records and destination information to test the allegation path by path.

In an illustrative departure dispute, a synchronization client may explain file activity that first appears suspicious. The examination compares timing, destination, configuration and the relevant files with the employee's authorized work. Where the records support copying, we explain that support in detail. Where they show only access or opportunity, we say that just as plainly, because the opinion that survives cross examination is the one that never claimed more than the evidence.

The final timeline distinguishes source files, recorded actions and inferred relationships. A gap in the logs proves neither side’s case, so the timeline shows exactly where each record source runs. You receive the supported findings and a precise list of what further discovery could add, which is what you need to decide how hard to press the claim.

Have a departure dispute where the file activity looks suspicious but unexplained? Describe the activity and the employee’s role and we will say which records could settle it.

The providers publish the definitions of the audit records most often involved in a transfer examination. See Microsoft: audit activity definitions ↗ and Google: Drive log events ↗.

If the audit records in your matter come from one of these platforms, tell us the tenant, the period and the retention in place and we will say what the logs can still show.

For data exfiltration expert witness work, the examiner who performs the analysis is the examiner who explains it at deposition and trial. Robert Knudsen combines eighteen years of forensic experience, hundreds of computer and mobile device examinations in federal and state court matters and the Certified Computer Examiner and CISSP credentials. Veronica Perez focuses on mobile device evidence and has been designated as a digital forensics expert in state courts and in federal court. Meet the GDF team, then ask for a current CV. Which examiner takes the matter depends on the devices and accounts involved, and availability and conflicts are settled on the first call.