Case Study 2 — Certain, and Wrong: How a Winnable IP-Theft Case Collapsed

The departing engineer probably did take the source code. The company still lost — not because the evidence wasn't there, but because the examiner they hired was so sure of the answer that he stopped serving the truth and started serving the client. A cautionary mirror of Case Study 1: same field, opposite outcome, and every wound self-inflicted.

Background

This is anchor case #2 — the employee who covered their tracks — but told from the side that lost. A robotics firm suspected a senior controls engineer of copying a proprietary design repository in his final two weeks before resigning to a direct competitor. The artifacts that would later (in the hands of a careful examiner) tell a clean story were all genuinely present: a USB mass-storage device with serial 4C530001234567890123 connected on a Friday at 18:51, TurbineHousing_v7.sldprt opened from it at 19:04, and the tell that anti-forensics rarely beats a thorough examiner — $STANDARD_INFORMATION` timestamps altered to hide activity while the `$FILE_NAME MFT timestamps preserved the truth (Chapter 16, Chapter 21).

The company retained an outside examiner. Two facts about the engagement, both undisclosed, poisoned everything downstream. First, his firm was simultaneously negotiating a lucrative ongoing managed-forensics retainer with the same company, and his engagement letter included a "successful resolution" bonus — a contingency-flavored incentive that paid more if the company prevailed. Second, the general counsel framed the matter on day one in five words the chapter warns about: "We know he did it — just find the proof."

He did not disclose the conflict. He did not guard against the framing. He went looking for proof.

What went wrong

The technical findings he could have made were solid. What he did with them was not.

He let context set the conclusion. Handed the narrative before the artifacts, he weighted everything that fit and explained away everything that didn't. The engineer's USB connection three weeks earlier — which logs showed was a sanctioned, IT-approved backup — got folded into the "exfiltration pattern" without qualification. A second device that connected once and copied nothing was described as "consistent with staging." He never documented a single alternative hypothesis. He never noticed that each result relieved him.

He overstated inference as finding. His report's headline conclusion read: "The employee intentionally stole the TurbineHousing design in order to deliver it to [competitor]." Intent and destination are not things you can read out of a registry hive. The defensible finding — "device serial 4C53…0123 connected at 18:51; TurbineHousing_v7.sldprt was opened from it at 19:04; $FILE_NAME` timestamps indicate the access despite altered `$STANDARD_INFORMATION values" — was buried under an inference dressed as fact.

He blew the scope. The litigation hold and the company's authority covered the engineer's work profile on the company-owned laptop. Convinced the "real evidence" must be hidden, he mounted and combed the entire image, including a personal, cloud-synced folder containing the engineer's medical records and intimate photographs of the engineer's spouse — none of it within scope, none of it minimized, and one off-scope personal file actually quoted in an appendix to "establish character." On a 2 TB image there are no rooms; he treated that as a license rather than a warning, and called the whole sweep "plain view."

He validated nothing and rounded up his CV. He ran a single carving tool he had never tested against a known reference set, and his curriculum vitae listed a certification that had lapsed and "100+ examinations" against an actual count nearer forty.

The collapse

The competitor's counsel did what Chapter 27 trains you to expect, and the structure handed them every lever:

DEFENSE: "Your fee rises if your client wins — correct?"
EXAMINER: "There's a resolution bonus, yes."
  → Testimony challenged as bought; the contingency-flavored structure
    treated as grounds to exclude the opinion entirely.

DEFENSE: "Your report says he 'intended' to deliver it to a competitor.
          Which artifact records his intent?"
EXAMINER: "Well — the totality —"
  → A labeled finding would have survived; an inference dressed as fact
    did not.

DEFENSE: "Your authority covered the work profile. You read my client's
          wife's medical records and personal photographs and quoted them.
          Under what authority?"
  → Suppression motion on scope; the off-scope sweep taints the lawfully
    obtainable evidence with it. A privacy counterclaim follows.

DEFENSE: "You claim a certification that lapsed in 2024 and '100+' exams.
          Your engagement file shows 41. Were you truthful about the rest?"
  → Once one misrepresentation under oath lands, the jury may disbelieve
    everything else he said.

The judge suppressed the device and timeline evidence as tainted by the off-scope search, excluded the examiner's opinion for the undisclosed contingency arrangement and the CV misrepresentation, and the company — which very likely was the wronged party — settled from a position of weakness while facing a privacy counterclaim over the spouse's data. The engineer, who in all likelihood did take the design, walked away clean.

That is the chapter's hardest sentence made literal: a contaminated examination of a guilty person can free them. The evidence was there. The examiner destroyed his own ability to prove it.

The analysis

1. Objectivity is structural, not optional. The moment an examiner is shown to have shaded toward the retaining side, the testimony collapses and every other case becomes impeachable. He was selling one thing — the belief that he reports what he finds — and he sold it for a bonus.

2. A finding is what the artifact says; an inference is what you think it means. "Device connected at 18:51; file opened at 19:04" is sourced and survivable. "He intended to betray the company" is an inference no hive records, and letting it borrow the certainty of a finding is what cross-examination exists to expose.

3. Conflicts must be disclosed, and contingency fees refused. The bonus paid him to reach a conclusion. Disclosed and restructured at engagement, it would have been a manageable fact; concealed, it became the lever that excluded his opinion. Disclosure converts a scandal back into a fact the system can manage.

4. Scope discipline protects the evidence you are entitled to. Browsing the whole image and calling it plain view did not just violate the engineer's privacy — it tainted the lawfully obtainable evidence, getting the real proof suppressed alongside the off-scope material. The truth-serving move (stay in scope; seek expanded authority for anything beyond it) and the legally durable move were the same move he refused to make.

5. Competence and honesty about credentials are load-bearing. An unvalidated tool and a padded CV had nothing to do with whether the engineer copied the files — but each gave the defense a clean shot, and the CV lie let the jury discount everything. The durable expert validates the tool, documents it, and claims only the credentials they hold.

Discussion questions

1. The general counsel's "we know he did it, just find the proof" set the whole failure in motion. Describe the three procedural defenses (linear sequential unmasking, blind peer review, documented alternative hypotheses) the examiner could have used, and show specifically how each would have changed his handling of the earlier, sanctioned USB backup.

2. Rewrite his headline conclusion as a defensible finding plus a separately labeled, properly qualified inference. What, if anything, is an examiner permitted to say about intent — and how must it be framed?

3. The undisclosed bonus was the single most damaging fact. Draft the disclosure-and-restructuring he should have sent at engagement, and explain why disclosure would have preserved rather than weakened his testimony.

4. ⭐ The off-scope search tainted the in-scope evidence. Suppose he had instead, mid-examination, stumbled across the medical and intimate material incidentally while legitimately searching the work profile. Write the three-step disciplined response (stop; document precisely what he saw and how he lawfully came to see it; seek expanded authority or a filter-team referral) and explain how that path keeps the device-and-timeline evidence admissible.

5. The engineer probably was guilty, yet he went free. Use this to argue against "noble-cause corruption" — the belief that a righteous goal justifies a thumb on the scale — and connect it to anchor case #4: why is a contaminated examination especially catastrophic when you are certain the person is guilty, and how does Case Study 1's recovery technician embody the opposite discipline?