Introduction

Trade secrets are core assets for businesses. With the acceleration of digitization, trade secret breaches have grown in frequency in recent years. These incidents not only harm the economic interests of businesses but can disrupt the industry ecosystem. In 2024, China prosecuted 3,266 individuals for copyright infringement, marking an average annual growth rate of 43.5% since 2020, according to the "White Paper on Intellectual Property Prosecution Work (2024)" released by China's Supreme People's Procuratorate. The report also noted a 12.4% year-over-year increase in trade secret infringement cases, with 163 cases involving 385 individuals [1]. Against this backdrop, digital forensics analysis has emerged as an important method for investigating trade secret infringements.

The Importance of Digital Forensics

In trade secret litigation, digital forensics can provide crucial evidence to help courts and lawyers determine if an infringement has occurred. Electronic data, which leaves traces without being detected, is commonly regarded as an important source of evidence. However, electronic data can be easily challenged in court by the opposing party due to its technical complexity and vulnerability to data tampering. Professional digital forensics can reconstruct data breach pathways, trace user activity logs and build comprehensive event timelines, thereby providing a scientific basis for judicial decision-making.

Application of Digital Forensics in Trade Secret Litigation

1. Communication records analysis

Communication records analysis is a vital forensic method of gathering evidence. It primarily involves analyzing temporary files from communication tools such as email and other communication and messaging platforms to uncover clues related to trade secrets.

Electronic Discovery (eDiscovery) has become a core technology for email and instant messaging data analysis. By analyzing the timing of communication, it helps identify anomalous activities — such as sending sensitive information outside of working hours or frequently transferring data to external email accounts — thereby providing critical evidentiary support for corporate compliance management.

2. External devices analysis

In the forensic analysis of external device records, digital forensic experts pay particular attention to USB storage devices, external hard drives and other types of removable storage media. These devices are commonly used media for data transfer and constitute one of the primary channels for trade secret leakage.

3. Deletion analysis and data recovery

Analyzing metadata such as file creation times and modification times can help identify suspicious user behavior. This approach provides valuable information for further investigating abnormal behavior. Additionally, the original paths of deleted files can be used to infer potential channels of trade secret leakage.

4. Forensic analysis of mobile devices and cloud storage:

As corporate-issued mobile devices (such as smartphones and tablets) and cloud storage (such as cloud drives) become critical platforms for information exchange, comprehensive forensic analysis is essential. There are two key aspects to this:

• Prevention: Companies can deploy internal Mobile Device Management (MDM) and Enterprise Mobile Management (EMM) software to prevent trade secret leakage. For cloud storage, Data Loss Prevention tools (DLP) can be used to continuously monitor network traffic for abnormal data transfers and prevent leaks of sensitive information.
• Post-Incident Response: Digital forensic experts can preserve evidence on mobile devices and analyze software logs and temporary files from cloud storage to make a preliminary determination about whether a trade secret leakage has occurred.

Legal and Regulatory Considerations

The digital forensics process must strictly adhere to relevant laws and regulations to ensure that the digital evidence collection is legal and compliant.

For example, the Clause No.9 of Anti-Unfair Competition Law of the People's Republic of China defines trade secrets and their protection measures, while the Cybersecurity Law of the People's Republic of China mandates that enterprises and individuals comply with information security standards. These laws and regulations provide a legal basis for and set the boundaries for electronic evidence collection.

In practice, to enhance the admissibility of electronic evidence, we highly recommend collaborating with Chinese notary offices to notarize the evidence preservation process.

Case Study

In a typical trade secret litigation case, a technology company suspected that several former employees had leaked its core algorithm to a competitor. The company engaged Alvarez & Marsal’s digital forensics experts to conduct a multi-step analysis. A&M’s experts were able to achieve the following results for the client:

• First, they recovered deleted files from relevant employees' work computers.
• Next, they reconstructed the data transfer timeline by analyzing external device connection records.
• Subsequently, through an in-depth review of emails and instant messages, they discovered suspicious communications between the former employees and the competitor.

Finally, A&M forensic experts identified the specific method and approximate timeframe of the trade secret breach, which provided strong evidential support that was critical to the case's successful outcome.

Conclusion

In summary, digital forensics analysis plays an indispensable role in trade secret litigation. By employing evidence-based collection methods, it not only effectively uncovers infringement but also assists businesses in recovering economic losses.

As technology advances and legal frameworks continue to improve, digital forensics will play an increasingly important role in the future of trade secret protection.

Reference:

[1]. Supreme People's Procuratorate of the People's Republic of China, “知识产权检察工作白皮书（2024）” [White Paper on Intellectual Property Prosecution Work (2024)], https://www.spp.gov.cn/xwfbh/wsfbh/202504/t20250423_693689.shtml