The departure of a senior employee to a direct competitor is among the most common triggers for an IP and trade secret investigation, and among the most time-sensitive. The window between departure and the embedding of the stolen information in the competitor’s business is often short: a skilled employee can integrate confidential client information, technical data, or strategic intelligence into a competitor’s operations within weeks of joining. Once that information is embedded, the harm becomes harder to attribute, harder to quantify, and harder to remedy through legal proceedings.
At Bond Rees, we respond to these instructions with the urgency they require. This article explains what we investigate, how quickly we can begin, what the investigation establishes, and how we support the legal proceedings that typically follow.
What You Are Entitled to Protect
Before the investigation begins, it is important to be precise about what the employer is entitled to protect. English law draws a clear distinction between two categories:
Information the employer can protect: specific confidential information that is the employer’s property and that the employee had access to in their employment. This includes: customer and contact lists compiled by the employer; technical data, formulas, and processes; strategic plans, pricing models, and financial information; and any information that is specific to the employer’s business and that derives commercial value from its confidentiality.
Information the employee is entitled to use: the general skills, knowledge, and experience that the employee has developed during their employment and that they carry in their head as part of their professional competence. An employee cannot be prevented from using their expertise and experience in a new role, even if that expertise was developed entirely during their employment. The line between protected confidential information and legitimate personal competence is a legal question, but the investigation provides the factual foundation for drawing it.
The Pre-Departure Period: What to Look For
The forensic investigation typically focuses on the period immediately before the employee’s departure — the days and weeks during which, if misappropriation occurred, the information is most likely to have been exfiltrated. The specific indicators we look for are:
Unusual File Access Patterns
An employee who has given notice and is counting down to their last day has no legitimate reason to be systematically accessing files outside their normal working scope. A pattern of late-night file access, access to client files outside the employee’s direct portfolio, or access to technical or strategic materials beyond what their role requires, is a significant indicator. The file access logs maintained by modern systems record every access event with a timestamp, and the forensic analysis of these logs is one of the most reliable ways to establish what the employee was doing in their final period of employment.
Data Transfer Events
Connection of USB devices, synchronisation with personal cloud storage accounts, forwarding of files to personal email addresses, or printing of unusual volumes of material. Each of these leaves a recoverable trace in the system logs, and the specific files involved — not just the volume of the transfer but the individual files that were copied — can typically be identified through forensic analysis.
Communication with the New Employer
Communications between the departing employee and their new employer in the period before they leave — particularly where those communications reference specific clients, technical matters, or commercial arrangements that are confidential to the current employer. These communications may be on work email, on personal email forwarded through the work system, or on messaging applications installed on the work device.
Deletion Activity
An employee who deletes files, clears their browser history, or empties the recycle bin in an unusual way in the period before departure is exhibiting conduct that warrants investigation. Deletion of evidence is itself a relevant fact; and deleted files can frequently be recovered by forensic tools from unallocated disk space.
What the Investigation Establishes
The Exfiltration Evidence
The primary output of the digital forensic investigation is a specific, documented picture of what was taken: the exact files involved, the transfer mechanism used (USB, cloud, email, or other), the timestamps of the transfer events, and the destination to which the files were sent. This specificity is important for legal proceedings: a general allegation that ‘information was taken’ is a significantly weaker foundation for an injunction or a damages claim than ‘the following specific files were copied on the following dates through the following mechanism’.
The Use at the New Employer
Establishing that the stolen information is being used at the new employer is the most challenging element of the investigation, because it requires intelligence about what the competitor is doing with information that is in their possession rather than the claimant’s. The investigation approaches this through corporate intelligence: analysis of the competitor’s current products, services, client base, and commercial activities for evidence of the specific information taken; analysis of their development timeline to assess whether their current position is consistent with independent development or with the use of stolen information; and open source investigation of any public disclosures by the competitor that reflect knowledge they should not have.
Breach of Restrictive Covenants
If the employee is subject to non-compete, non-solicitation, or non-dealing restrictions, the investigation also establishes whether those restrictions are being breached in their new role: whether they are working for a direct competitor within the restricted period and geography; whether they have contacted former clients or customers; and whether they have recruited former colleagues. This is addressed in depth in our dedicated article on restrictive covenant investigations.
The Legal Response
The investigation produces the evidential foundation for a coordinated legal response that typically involves one or more of the following:
Interim injunction: an emergency application to prevent the continued use of the stolen information, typically sought on a without-notice basis if there is a risk that the defendant would take steps to conceal or embed the information if they were given advance notice of the application.
Search and imaging order: an order requiring the defendant to permit the imaging of their devices, to identify and preserve the specific files that are the subject of the claim.
Delivery up or destruction: a final order requiring the defendant to deliver up or destroy all materials derived from or containing the stolen information.
Damages or account of profits: compensation for the loss caused by the misappropriation, or an account of the profits the defendant has made through the use of the stolen information.
Frequently Asked Questions
What if the employee has already been at the new employer for several months?
The investigation is still valuable, and legal proceedings may still be viable, but the urgency is different. Where several months have passed, the forensic evidence on the employer’s own systems is more likely to have been partially overwritten, and the argument that the competitor’s current business position results from the use of stolen information rather than legitimate development becomes more difficult to establish. The investigation still establishes what was taken and provides the basis for a damages claim even if an injunction is no longer the primary remedy.
What about the employee’s restrictive covenants — can they really enforce them?
This is a legal question on which the employer needs advice from an employment solicitor, but the short answer is: it depends on the specific covenants, their drafting, the employee’s seniority, and the specific activities they are now engaged in. Courts have been willing to enforce well-drafted restrictive covenants where there is a legitimate business interest to protect and where the restrictions are proportionate in scope, duration, and geography. The investigation establishes the factual picture that the solicitors need to advise on enforceability and to support any application for injunctive relief.
Can we contact the new employer directly?
Yes, in principle. A letter before action to the new employer, informing them of the misappropriation and the legal position, is a standard step in many cases and can result in settlement without the need for proceedings. Whether and when to contact the new employer is a tactical decision that requires legal advice, because early contact can also prompt the destruction of evidence or the embedding of the stolen information more deeply into the competitor’s business before legal process can be obtained.
Former employee gone to a competitor with your confidential information? Contact Bond Rees for urgent investigation support.
