Recovery of circumstantial digital evidence leading to an Anton Piller order: A case study

Abstract

The authors describe the techniques used to gather and analyse evidence of theft of intellectual property, specifically the customer records of their client, by a former employee, for the purpose of obtaining an Anton Piller order to seize records from the former employee’s new offices. Importantly, it was not possible to find significant prima facie evidence, but a compelling circumstantial case was built up, based on the recovery and analysis of a large number of access records to the customer database. These records were inadvertently stored on the iMac computer (previously used by the respondent) in the form of intranet web addresses (URLs) in deleted and current files throughout the hard drive, despite obvious efforts to delete a wide range of files and records from the computer.