CASE STUDY 4: COMPUTER FORENSICS

---

The founder and majority shareholder of a consultancy business sold his interest to a multinational communications corporation. The contract of sale contained restraint clauses, prohibitions on the removal of confidential information, and nonsolicitation of staff and client clauses. After about a year, the client-the multinational-became suspicious that he was acting in breach of contract. A computer forensics firm was asked to investigate. At the outset, the firm suggested that the individual's desktop and laptop computer be recovered to copy the hard disks and analyze their content. Within an encrypted file on his desktop, the firm found a draft business plan for a new enterprise that would compete with his former business. On his laptop, in a deleted file that was restored, the firm recovered details of key clients and revenue streams. It was possible to demonstrate that information had been updated within these files after he had left the company, but before he had returned the computer. Taken together, the evidence was sufficient to initiate criminal proceedings.

---