A trade secret and IP theft investigation is a structured, attorney-directed inquiry that establishes - through admissible evidence - what proprietary information was taken, who took it, how it was taken, and where it went. Done correctly, it produces a forensic record strong enough to support a temporary restraining order, an injunction, or a Defend Trade Secrets Act claim. Done incorrectly, it spoils the very evidence the case depends on. Most of the difference comes down to what happens in the first 72 hours.

Why trade secret investigations are different from ordinary employment investigations

A standard HR or workplace misconduct inquiry can usually be conducted quietly inside the company. A trade-secret investigation cannot. The subject is almost always a departing or recently-departed employee, the evidence is almost always digital, and the eventual audience is almost always a federal court. That means the investigation has to be designed from day one to survive cross-examination - chain of custody, witness statements, forensic images, and surveillance, all coordinated under attorney-client privilege.

The exposure is significant. Estimates of annual U.S. losses from trade secret theft range from $180 billion to $540 billion - roughly 1% to 3% of GDP - according to the long-standing Commission on the Theft of American Intellectual Property report (IP Commission, 2017 update). And federal prosecutors continue to bring high-profile economic-espionage cases under the Defend Trade Secrets Act of 2016, which created a federal civil cause of action for misappropriation (DOJ, 2016 DTSA fact sheet).

In our 30+ years working with corporate counsel on these matters, the single most common mistake is delay. Companies sense something is wrong - a departing engineer’s USB activity spikes, a sales rep walks with a customer list, a key formula appears at a competitor - and the company spends weeks debating internally before engaging a professional investigator. By the time we are called, the laptop has been reissued, the email is gone, and the trail is cold.

What a trade secret investigation actually covers

A defensible investigation is built around four parallel workstreams, all coordinated under attorney-client privilege and with a written investigative plan signed by counsel.

•           Digital forensics: forensic imaging of the subject’s company laptop, phone, and external devices; preservation of cloud activity logs (Microsoft 365, Google Workspace, Box, Dropbox); USB and printer logs; chat and email export; and a timeline of file access in the 90 days before departure. This is almost always the spine of the case.

•           Open-source and dark-web intelligence: review of the subject’s public LinkedIn, social media, and professional posts; corporate filings for any new entity; and selective dark-web monitoring for stolen data or credentials.

•           Field surveillance and direct observation: where the threat picture warrants and counsel approves, surveillance of meetings, courier handoffs, or new-employer activity. This is conducted under the discipline of the case for investigating before counsel files, so that the record exists by the time the complaint is drafted.

•           Witness statements and HR record review: structured interviews with co-workers, supervisors, and IT staff; review of the subject’s employment file, NDA, non-compete, and any prior PIPs; reconstruction of pre-departure behavior.

Each workstream produces evidence in a chain-of-custody-protected form, and each one is documented in a way that maps cleanly to the eventual pleadings. That mapping is what we describe in detail in our guide on how investigative work supports the litigation timeline.

How to act in the first 72 hours

The first three days set the ceiling for what the case can prove. The following sequence is what we run, in coordination with counsel, when a credible trade-secret event is suspected:

1.         Engage outside counsel immediately and bring the investigator on under privilege.

2.         Preserve the digital environment: pause auto-deletion policies, image the subject’s laptop and phone, and pull cloud-storage and email logs before any reissue.

3.         Lock down access: revoke credentials, disable remote access, and identify any second-degree contacts who may have received the data.

4.         Document the company’s reasonable measures to protect the trade secret - the DTSA requires this showing, and a clean record of NDAs, access controls, marking, and training is decisive.

5.         Begin a written investigative timeline that will be updated weekly through filing.

A case that begins with this sequence is dramatically easier to support at TRO and injunction stage than one that begins three weeks later.

Coordinating with corporate counsel and outside firms

The investigator’s job is to make the lawyer’s job easier. That means understanding which exhibits attach to the TRO motion, which deposition outlines need investigator-produced timelines, and which expert witnesses will rely on the forensic image. In federal DTSA litigation, the work product almost always supports:

•           An ex parte seizure application (rare but available under DTSA).

•           A TRO and preliminary injunction motion.

•           Document requests and subpoenas to the new employer.

•           Depositions of the subject and co-conspirators.

•           A damages model that quantifies head-start advantage and unjust enrichment.

A professional investigator who has worked alongside corporate counsel in this lane - and understands what evidence the court will actually admit - is a force multiplier on a tight litigation timeline.

Frequently asked questions

When should a company bring in a private investigator on a suspected trade secret theft?

Immediately, and in coordination with outside counsel. The first 72 hours determine what evidence is recoverable; engaging an investigator under privilege at the start ensures forensic imaging, log preservation, and any field work are done correctly. Waiting weeks to “see how it plays out” almost always degrades the case.

What evidence holds up best in a trade secret case?

Forensic images of devices, cloud-activity logs, USB and printer records, and admissible witness statements collected under privilege. The Defend Trade Secrets Act also requires the plaintiff to show reasonable measures to protect the trade secret, so a clean record of NDAs, access controls, marking, and training is decisive.

Does NBI work directly with corporate counsel or directly with the company?

Both, but engagements on suspected IP-theft matters are nearly always run under attorney-client privilege with counsel as the engaging party. That structure protects the investigative work product and gives counsel the cleanest possible record to take into court.

How long does a trade secret investigation typically take?

The forensic and open-source workstreams produce an initial picture within 7 to 14 days, sufficient to inform a TRO or injunction filing. The full investigation - including any field surveillance, follow-on witness interviews, and dark-web monitoring - typically runs in parallel with the litigation for 60 to 120 days, with the investigative team supporting depositions and damages analysis through trial.

Can investigators legally surveil a former employee at a new employer?

Within strict legal bounds, yes. Surveillance is limited to public spaces and lawful methods; we do not enter the new employer’s premises, intercept communications, or use any pretext that violates state investigator-licensing laws or the Wiretap Act. Every surveillance plan is reviewed with counsel before deployment.

What does NBI deliver to corporate counsel at the end of an investigation?

A written investigative report under privilege, all forensic images preserved with chain-of-custody documentation, surveillance logs and video with sworn investigator declarations, and a witness-by-witness summary of statements taken. Each deliverable is structured to attach as an exhibit or support an expert report.

Take the next step on a suspected trade secret event

If your company or your firm suspects a trade secret or IP-theft event, the most consequential decisions are made in the first 72 hours. NBI works directly with corporate counsel under privilege to image devices, preserve logs, run lawful field work, and produce a forensic record built for federal court. To schedule a confidential consultation, contact NBI at investigations-nbi.com/contact.

About the Author

Michael D. Julian brings 30+ years of investigative and protective-services leadership to corporate, attorney-directed, and insurance-defense matters. He served as President of the California Association of Licensed Investigators (CALI) from 2005 to 2015 and has worked alongside corporate counsel on complex civil, IP, and workplace investigations across the United States. Connect with Michael on LinkedIn.