The situation
A software company accused a top salesperson of stealing customer information for use at a competitor. The case proceeded through the Federal Court and was appealed to the Full Bench.
The company had already engaged another forensics firm, but their basic analysis proved inadequate. The initial forensic work lacked depth and rigour, and the company needed certainty about the data theft for damage assessment. They engaged us for a second opinion.
Details in this case study have been altered to protect client confidentiality. The core facts, forensic methodology, and outcomes are accurate.
What we found
We re-analysed the evidence using advanced techniques and rigorous scientific methodology. Our investigation demonstrated:
- The salesperson copied files to a USB stick, proving unauthorised transfer of data
- Information was copied and pasted from Sugar CRM into Excel, showing deliberate extraction of customer records
- A different computer was used to extract CRM system information, indicating premeditation
- Log files from old tape backups were reconstructed to reveal reports run by the ex-employee before departure
We also developed strong scientific responses to the salesperson’s counterclaims about the evidence.
How we responded
- Evidence re-analysis using advanced forensic techniques the first investigator did not apply
- Tape backup reconstruction recovering historical log files that revealed the full timeline of data access
- IRIS Challenge review ensuring every finding withstood adversarial scrutiny before inclusion in the report
- Expert report and testimony prepared for Federal Court proceedings, including cross-examination
The outcome
The investigation produced strong evidence of customer information theft, leading to damages awarded in the client’s favour. The evidence’s scientific validity gave the client confidence through the appeal process.
The Full Bench of the Federal Court stated: “Mr O’Kane’s evidence explained how that material was found and expressed an opinion as to what that meant.” (Garner v Central Innovation Pty Limited [2022] FCAFC 64)
Lessons for similar organisations
- The choice of forensics professional significantly impacts case outcomes. Basic analysis can miss critical evidence. Advanced techniques and rigorous methodology make the difference in court.
- Second opinions can uncover what others missed. A fresh set of eyes with different techniques may find evidence that was inadequately analysed the first time.
- Old backup media can contain crucial evidence. Tape backups and archived logs are often overlooked but can reconstruct a complete timeline of employee activity.