Corporate Investigations & Forensic Auditing • Houston, Texas
Corporate Fraud & Departing Employee IP Theft
Forensic timeline reconstruction, USB mass storage tracking, and trade secret exfiltration analysis for non-compete violations, corporate embezzlement, and commercial litigation.
How Does a Digital Forensics Investigation Prove Departing Employee Data Theft?
Digital forensics investigations prove employee data theft by extracting deterministic file system artifacts prior to departure. E-Investigations analyzes Windows Registry keys (USBSTOR), Shellbags, LNK shortcut files, and cloud storage event logs (OneDrive, Google Drive, Dropbox) to verify exact exfiltration timestamps, document names, and connected storage volume serial numbers for federal and Texas commercial litigation.
The Anatomy of a Corporate Data Exfiltration Investigation
When key executives, lead sales directors, or senior engineers depart for a competitor or launch a competing enterprise, they frequently attempt to misappropriate proprietary client lists, confidential pricing algorithms, source code, and design documents. Most departing employees mistakenly believe that deleting files or emptying the Recycle Bin conceals their activities.
Every interaction with an operating system leaves persistent forensic breadcrumbs across non-volatile memory. Lead Examiner Gary Huestis interrogates internal forensic artifacts to build an airtight evidentiary timeline:
1. USB Device Tracking (USBSTOR)
We extract the unique vendor, product name, and serial number of every USB flash drive, external SSD, or smartphone ever connected to the workstation, correlating device insertion with specific file modification timestamps.
2. Shellbags & LNK Artifacts
Windows Shellbags store user viewing preferences for folder hierarchies. We prove that a departed custodian navigated specific folders on an external drive or network share, even after the external drive has been disconnected.
3. Cloud Exfiltration Audits
We audit local synchronization SQLite databases and web browser cache artifacts to prove unauthorized uploads of enterprise files to personal Dropbox, Google Drive, Box, Microsoft OneDrive, and personal webmail accounts.
Exposing Anti-Forensics & Intentional Evidence Destruction
Sophisticated bad actors frequently deploy scrubbing software or timestomping utilities in an attempt to thwart discovery. E-Investigations detects and documents anti-forensics measures:
- Wiping Utilities: Detection of CCleaner, BleachBit, Eraser, and PowerShell secure-wipe scripts executed in the days leading up to resignation.
- Timestomping Identification: Microsecond discrepancy analysis between
$STANDARD_INFORMATIONand$FILE_NAMEattributes in the NTFS Master File Table (MFT) proving modified file creation timestamps. - Volume Shadow Copy Analysis: Restoring deleted files and prior system states from un-purged Windows Volume Shadow Copies (VSS).
- USN Journal Carving: Reconstructing the exact sequence of created, renamed, and deleted files using the NTFS Update Sequence Number (USN) change journal.