Digital Forensics is highly utilized for Non-Compete, IP Theft and Non-Solicitation matters as valuable Electronic Evidence can be gathered during digital investigation in these types of cases.

Non-Compete | IP Theft | Non-Solicitation

IP Theft, Non-Compete and Non-Solicitation matters involve similar investigative techniques.

These matters involve identifying whether individuals that have left one organization have taken intellectual property (IP) and/or are in violation of a non-compete agreement, non-solicitation agreement or other such protective covenant. Depending on the strategy of the case and the egregiousness of the actions, the lack of any kind of protective covenant hasn’t prevented clients from being able to prove damages and win their case.

Vestige is well-positioned to respond to the time-sensitive nature of these intellectual property theft cases. Our understanding of the manner in which to prove these IP theft cases, our ability to quickly and accurately analyze the data and to articulate the findings often helps support motions for Temporary Restraining Orders (TROs), help the legal team prepare for Preliminary Injunctions and to support Motions to Compel the Production of Computer Systems owned and/or operated by the party opponent.

How we help Plaintiffs

There are numerous items that help establish one way or another whether intellectual property theft has occurred and/or the individual(s) are in violation of a protective covenant. Typically, the strongest evidence of such behavior is on the system(s) of the party opponent. However, without reasonable cause, a judge is not going to be persuaded to allow an investigation of the opponent’s system. Therefore, Vestige is adept at investigating the system(s) of the investigating company to  uncover and interpret the artifacts that prove or disprove the allegations of whether intellectual property theft has occurred or evidence exists that the individual(s) is in violation of non-compete or non-solicitation agreement.

Artifacts (digital footprints) left on the system evidencing malfeasance in these matters include:

  • Proof that external media, such as USB flash drives, external USB hard drives, etc., has been connected and IP copied to it
  • Printing of sensitive/confidential information
  • E-mailing of IP material to an outside e-mail account (i.e. home e-mail account such as Yahoo!, GMail or other account)
  • Burning of IP material to CD/DVD
  • Accessing sensitive information out-of-the-ordinary course of the individual’s normal activity
  • E-mail or other correspondence providing evidence that such activity has taken place
  • Analysis of deletion and/or “clean-up” activity

In those situations where an intellectual property violation has occurred, Vestige is ready to provide the evidence and support it with a report and testimony. In those other situations where no violation has occurred, Vestige provides adequate assurance to the hiring party that a violation has not occurred.

How we help Defendants

Oftentimes activity that is conducted and analyzed by IT personnel that is not a Computer Forensic Expert is misinterpreted. Given the adversarial nature of the legal process, the related costs and the desire to move quickly, incorrectly interpreted artifacts and activity can cause unnecessary problems. Vestige has helped defendants incorrectly accused of violating non-compete/non-solicitation restrictive covenants or accused of “stealing” intellectual property. And, since Vestige always maintains neutrality in all cases, should the evidence contradict the defendant’s position, as our client, we would let you know that as well.

Vestige TheftNet℠ Service

TheftNet℠ is a combination of Investigating, Consulting and Testifying Expert services, performed by Electronic Evidence Experts at Vestige on relevant corporate electronic devices to permit a client to rapidly assess and interdict, react, and/or prove unauthorized access, copying, removal, transfer or use of intellectual property and/or confidential information by current or former employees, officers or directors of an organization.

TheftNet℠ Case Types

  • Violation of non-compete and non-solicitation agreements
  • Theft of Intellectual Property
  • Breach of employment agreement fiduciary duty
  • Violation of Computer Fraud and Abuse Act
  • Violation of state laws related to accessing electronic information
  • Patent Infringement


Timely TheftNet℠ services satisfy two critical needs:

1) Assess the degree of risk that intellectual property has been compromised.
2) Respond to theft, misuse, wrongful access, and other improper uses of client intellectual property.

IP Theft Cases rarely are solved by reviewing content on media, instead the digital footprints that are left behind by the individual(s) involved are crucial. Vestige expertise is in identifying, analyzing and opining on these digital footprints.

Assess Risk

The most difficult challenge in theft of intellectual property matters is determining whether significant IP has been stolen. This is because not every potential risk of IP loss justifies the expense, disruption, and potential damage to relationships that may result from complete theft investigation. Crafting the proper response in a non-compete or IP theft case demands an early, quick assessment of the potential risk and scope of potential damage.



In many cases, clients know intellectual property has been improperly accessed or copied and need to prove the circumstances in a timely manner to support a wide variety of response options such as termination, temporary restraining order (TRO) or litigation. Vestige’s services are designed to address client’s assessment and response needs.

Vestige TheftNet℠ Packages

Utilized when a complete digital investigation and Vestige’s expertise is required throughout litigation. Includes full content and artifact analysis, combined with all affidavits, depositions, trial testimony and other services necessary to assist counsel seeing to use electronic evidence to achieve strategic goals within the matter.

For matters in which relevant sources of electronic evidence must be identified, preserved, and analyzed in an expedited manner; and expert opinion(s) formed and defended in Temporary Restraining Order Hearings.

This is a comprehensive investigative response. It includes preservation of critical electronic evidence and a complete basic forensic analysis based upon the content and artifacts. Includes verbal results.

This package is a 14-point evaluation of critical markers that provides clients with a score that reflects the existence of theft artifacts that are highly correlated with significant intellectual property loss. Based upon this risk assessment, clients can craft a response that reflects the degree and quality of evidence.

Contact Us today to discuss how Vestige can provide digital forensic services for your IP theft or non-compete matter.