Case type: Criminal law

Client : Law firm specialized in business law

Parties involved : Manufacturing company vs. Former employee

Mandate given to Firme H2E :

Recover and analyze deleted data from hard drive, USB key and cell phone

Duration : 20 business days

Context

A manufacturing company in the Montreal area suspected a former executive of copying confidential files — including client lists, proposals and pricing strategies — before leaving to join a direct competitor.

The employee had returned his laptop and company phone, both apparently “wiped” of any compromising content. The company’s lawyer engaged Firme H2E to perform a complete forensic analysis of the returned devices, including a USB key found in the former employee’s office.

The stakes were high: the company had lost three major contracts to the competitor in the weeks following the employee’s departure, representing over $500,000 in annual revenue.

Firme H2E Intervention

Step 1

Acquisition forensique des appareils

  • Creation of complete forensic images of the hard drive (E01 format), USB key and Android cell phone
  • Photographic documentation and chain of custody recording
  • Validation of copy integrity using SHA-256 hashes
Step 2

Recovery of deleted data

  • Hard drive analysis with X-Ways Forensics to recover deleted files and data fragments
  • Extraction of USB key content, including partially overwritten files
  • Use of Cellebrite UFED to extract SQLite databases from the Android phone
Step 3

Analysis and correlation

  • Reconstitution d’une chronologie des actions : copies USB, connexions au nuage personnel, envois de courriels
  • Identification of 847 confidential files copied to the USB key within 72 hours before the resignation
  • Discovery of deleted emails confirming document transmission to a personal address
Result

The Firme H2E report conclusively demonstrated that the former employee had systematically copied strategic documents before his departure.

The forensic timeline revealed that the deletion actions had occurred on the same day the devices were returned.

Faced with this evidence, the employee agreed to an out-of-court settlement including the return of all documents, an enhanced non-compete agreement and financial compensation.

Key Takeaways
  • “Deleted” data can often be recovered, even after a quick format
  • Multi-device analysis allows correlating actions and reconstructing a complete scenario
  • Speed of intervention is crucial: the more time passes, the more data risks being overwritten
Tools Used
  • X-Ways Forensics (hard drive and USB key analysis)
  • Cellebrite UFED (extraction mobile Android)
  • FTK Imager (forensic imaging)
  • SHA-256 for integrity validation
  • Custom forensic timeline (Firme H2E)

Have a case?

Submit it securely through our platform.

No emails. No delays. Use our dedicated submission system to get expert help fast.

Submit Your Case

Your information stays confidential and is reviewed by certified experts.