Departing Sales VP & Engineering Lift-Out (USB + Cloud Exfiltration)
When a senior sales executive and two engineers resigned within 48 hours to join a direct competitor, the employees returned their dual-drive workstations with emptied Recycle Bins and cleared browser histories. Using IPTheft™ v1.0.6, we completed a Phase 1 Deep Scan in under 20 minutes—correlating primary OS drives (EV-001-A) with secondary 1 TB data drives (EV-001-B), carving resident $Ixxxxxx deletion records from unallocated $MFT space, proving password-protected .zip staging of CAD assemblies, and linking an unrecovered external SSD’s hardware serial number across 123 provenance columns. The resulting .DOCX declaration and .PDF USB Report secured an immediate Temporary Restraining Order (TRO) and court-ordered turnover of the defendants’ personal devices.
Altered PDF Vendor Invoices & QuickBooks Embezzlement Audit
A mid-sized industrial contractor suspected a purchasing manager of routing six-figure payments to a shell vendor and copying the master QuickBooks Desktop (.qbw/.qbb) company file prior to termination. IPTheft™ Domain 3 analysis automatically flagged 14 supplier PDF invoices containing incremental-save %%EOF tampering markers where /ModDate > /CreationDate alongside browser and MRU traces proving the invoices were altered using online PDF editors, while QBWin.log and USBSTOR correlation proved unauthorized backup exports to a personal flash drive.
Defeating Mass Shift+Delete, CCleaner & Cleared Event Logs
After receiving a litigation hold notice, a custodian executed Shift+Delete on project bid folders, ran CCleaner, and cleared the Windows Security Event Log (Event ID 1102). Our 5-Layer NTFS Recovery Engine reconstructed the full original paths of over 400 deleted files from $Extend\$UsnJrnl:$J (flagging a mass-deletion burst of ≥25 files in 5 minutes), carved unlinked $FILE_NAME structures from $I30 (INDX) slack space, and unioned unreplayed regf Registry hives with .LOG1/.LOG2 transaction logs—establishing undeniable “intent to deprive” under FRCP 37(e)(2).
Remote Time-Theft (Mouse Jiggler), FMLA Location & Rebuttal Neutrality
In an executive employment arbitration, E-Investigations generated a 96-Bucket (15-Minute) Workday Activity Heatmap proving that a remote director kept Microsoft Teams green using a software mouse mover (Move Mouse / Caffeine) while performing zero substantive work across core 08:00–17:00 quarter-hours, and extracted WLAN-AutoConfig Wi-Fi SSID/BSSID telemetry proving out-of-state resort travel during claimed bedridden FMLA leave. Conversely, in defense/rebuttal engagements, our [EXC-001]–[EXC-008] and [EXC-PST-EMPTY] (271,360 bytes [271.36 KB / 265.00 KiB]) badges routinely exonerate falsely accused professionals by proving opposing examiners misread IT setup drives and empty Outlook skeletons.
Need Decisive Digital Evidence for Your Matter?
Call Principal Examiner Gary Huestis at (713) 628-4408 or submit a confidential case evaluation.