Case Study 1 — The Report That Drew Its Own Lines

A departing engineer was suspected of copying proprietary designs to a personal drive. The analysis was strong, but the case was won by the report — a document that separated fact from inference, documented what it could not prove, and recorded every negative search, so that when opposing counsel went looking for an overreach to attack, the only lines on the page were the ones the examiner had already drawn.

Background

This is the book's second anchor case — the employee who covered their tracks — seen at the moment it becomes a written record. Arclight Photonics, a mid-size optics firm, discovered that a senior design engineer had, in his final three weeks, opened an unusual number of files in the laser-driver design repository. He resigned on a Friday and began at a direct competitor the next week. Counsel anticipated a civil trade-secret suit and, just as importantly, anticipated that the competitor would retain its own forensic expert to attack whatever Arclight produced. The examiner was retained to image the company-owned laptop and report her findings — case 2026-0207, Item 01 — under the authority of the firm's acceptable-use policy and the login banner that consented to monitoring. There was no warrant and no law enforcement; this was civil litigation, and the deliverable would be an expert report that had to survive a deposition.

The analysis itself unfolded across the disciplines this book has already taught: USB device history pulled from the SYSTEM and software registry hives (Chapter 16), a timeline built with plaso (Chapter 21), and the telltale residue of an anti-forensic tool (Chapter 30). But this case study is about none of those techniques. It is about how the examiner wrote them down.

The report

The findings were genuinely incriminating, and that was exactly why the examiner wrote them with restraint. The registry showed a personal Samsung USB device (volume serial 1A2B-3C4D) first connected on 2026-06-18; LNK files and the $MFT` recorded the proprietary design files opened from that volume; and the file-access timestamps on several design documents had been altered — but the `$FILE_NAME attribute timestamps, which user-mode timestomping tools do not reach, preserved the true sequence (the MACB distinction owned by Chapter 21). Prefetch and AmCache even recorded the execution of a disk-cleaning utility the day before the laptop was returned.

The temptation, on facts like these, is to write a brief for the client. The examiner did the opposite. Each finding was built in four parts — observation, supporting artifacts, interpretation, limitation — and the conclusions stayed inside the fence the evidence built:

   FINDING F-009 — Removable device connected; design files opened from it
   ─────────────────────────────────────────────────────────────────────
   Observation (fact):
     Registry artifacts record a Samsung USB mass-storage device first
     connected to Item 01 on 2026-06-18T21:09Z. LNK target metadata and
     MFT records show eight files from the laser-driver design set were
     opened from volume serial 1A2B-3C4D.
   Supporting artifacts (reproducible — see appendices):
     • SYSTEM hive USBSTOR / MountedDevices entries (App. D, method Ch.16)
     • LNK files in Recent\, volume serial 1A2B-3C4D (Exhibit 9)
     • $FILE_NAME timestamps intact; $STANDARD_INFORMATION altered on 4
       files (timestomping indicator; see Finding F-011)
   Interpretation (supported inference):
     The artifacts are consistent with the design files having been opened
     from an external device connected to the laptop on the stated date.
   Limitation:
     Establishes the device connection and file-open events tied to the
     user account; does NOT establish which individual physically operated
     the device, nor that files were copied TO the device (no write-event
     artifact was recovered; see Finding F-010 and Limitations).
   ─────────────────────────────────────────────────────────────────────

Note the last line. The evidence showed files opened from the device; it did not, by itself, prove files were copied to it. A lesser report would have blurred the two. This one stated the gap plainly — and then the examiner did the thing that separates a professional from an advocate: she recorded her negative findings with the same care as the positive ones.

   FINDING F-014 (negative) — Search for alternative explanations
   ─────────────────────────────────────────────────────────────────────
   Observation: A search for malware, remote-access tooling, and automated
     cloud-synchronization processes that could account for the file
     activity identified none on Item 01.
   Supporting artifacts: AV-signature and YARA scans (App. C); autoruns /
     scheduled-task review; no sync-client install or logs located.
   Interpretation: The absence of an automated or remote process makes an
     explanation of the activity as background/automatic less likely.
   Limitation: A negative finding establishes only that none was FOUND on
     this image; it cannot exclude processes off-image or fully removed.
   ─────────────────────────────────────────────────────────────────────

She also reported, as Finding F-011, that an anti-forensic disk-cleaning tool had run — and noted candidly that the tool's own Prefetch and AmCache artifacts had survived it, so even the attempt to hide left a trace. Crucially, she did not editorialize: the finding said the tool ran, listed the artifacts proving it, and stopped. It did not say the engineer "tried to destroy evidence." That characterization was the lawyers' to argue; her job was the fact.

The conclusion, written last, was proportionate to all of it: "The file-access, removable-media, and timeline artifacts, together with the absence of any identified automated or remote process, are consistent with deliberate access to the proprietary design files from an external device on 2026-06-18. The evidence does not establish which individual physically operated the device." Before release, a second examiner ran a technical review, independently re-deriving the USB timeline from the hives, and a colleague did an editorial review for jargon and tone.

The deposition

The competitor's expert deposed her for a full day, hunting for the overreach that every weak report contains. He never found one, because the report had already conceded every boundary he tried to push her past:

OPPOSING: "Your report doesn't actually say the files were copied to the
           USB device, does it?"
EXAMINER: "Correct. Finding F-009 states the files were opened from the
           device and explicitly notes no copy-TO artifact was recovered.
           That limitation is in the report."

OPPOSING: "Couldn't malware have moved these files without the user knowing?"
EXAMINER: "I searched for that. Finding F-014 documents that no malware,
           remote-access tool, or sync process was identified on the image,
           and states what that negative finding can and cannot exclude."

OPPOSING: "Can you tell this jury that my client, personally, sat at this
           laptop?"
EXAMINER: "No. The report ties the activity to the user account and the
           device, and the Limitations section states that the forensic
           evidence alone does not identify the physical operator."

Every attack landed on a line the examiner had drawn herself, in writing, before he ever read it. The matter settled within six weeks.

The analysis

1. A report that draws its own lines cannot be cut along them. The examiner pre-empted the three hardest cross-examination questions — copied-to vs. opened-from, alternative explanations, account vs. operator — by stating each limitation in the report. An adversary's best weapon is the gap you left open; close them yourself and there is nothing to pry.

2. Negative findings are evidence, and they are armor. "I searched for malware and found none" did double duty: it strengthened the inference of deliberate action and proved the examination was impartial and complete. The examiner who omits the search surrenders the claim to thoroughness; the one who records it owns it.

3. Keep fact and inference on separate rungs — especially when the facts are damning. The strongest facts tempt the worst overreach. By writing "consistent with deliberate access" rather than "the engineer stole the designs," and by reporting that the cleaning tool ran rather than that he "destroyed evidence," she left the advocacy to the advocates and kept her credibility intact.

4. The account is not the person — say so in writing. The single most reliable cross-examination question in any digital case is "can you prove my client's hands were on the keys?" The honest answer is almost always no, and a report that states it first turns a damaging admission into a demonstration of rigor.

5. Review is part of producing the report, not a courtesy. A second examiner re-derived the timeline and a colleague checked the prose before release. The deposition found nothing because two friendly readers had already found everything — which is precisely the function of technical and editorial review.

Discussion questions

1. Finding F-009 distinguishes "opened from" the device from "copied to" it. Why does that distinction matter legally, and how would the examiner's testimony have been damaged if the report had simply said "the files were copied to the USB drive"?

2. The anti-forensic tool's own Prefetch and AmCache artifacts survived its attempt to clean the disk (theme: the absence of a trace is itself a trace; anti-forensics leaves traces). Draft the one-sentence finding reporting that the tool ran, written so it states the fact without editorializing about intent.

3. ⭐ Suppose the technical reviewer, re-deriving the USB timeline, had found that one cited timestamp was a $STANDARD_INFORMATION value altered by the timestomping (not a reliable connect time). Walk through what should happen next: how the finding is corrected, whether the conclusion survives, and why catching this before release is the entire point of review (compare the chapter's War Story).

4. The examiner recorded negative finding F-014 even though it slightly complicated a clean narrative. Argue why an impartial examiner is obligated to report exculpatory-tending searches, and explain how doing so paradoxically made the inculpatory conclusion stronger in the deposition.

5. This was a civil matter that may have produced a testifying-expert report. Using FRCP 26(a)(2)(B), list what the examiner would have had to add to the report of examination — and explain why forgetting to disclose even one opinion in that version could have barred her from offering it at trial.