The owner of an aerospace company that manufactured parts for the government called with some concerns. Recently two of his key sales people had left the company under a cloud of suspicion. The company owner had no tangible proof of wrong-doing, but he had a feeling something wasn’t right.
Both of the employees had been with the company for more than seven years and had always been straight up with him. But over the last year he felt his relationship with them changed. There was a distance that had developed and when they both suddenly resigned, it just didn’t feel good.
They had left their computers and cell phones that were company issued. He’d had IT look at the computer, but both cell phones were locked with unknown passwords. He asked if could help bypass the passwords and get into the files on the computer.
The ability to retrieve passwords is one of the forensic mobile services we can perform, but with the feeling he had, we wondered if he didn’t also want a cell phone analysis on the mobile devices. He agreed that would resolve the uneasy feeling he had.
After solving the password issue, our cellphone expert began the mobile phone forensic protocol. Cellular forensics includes creating a duplicate clone of the content of the phone at a given point in time. That file is then run through phone forensic software. Using that protocol, the original data in the device is never altered or destroyed. The mobile phone forensic analysis is performed on the duplicate copy.
A cell phone investigation includes the retrieval of a wide variety of data. In this instance it was the volume of calendar notes and email of the salesmen making appointments with key accounts that caught the eye of the owner. They had met privately with every one of the top 30 accounts and had dates set for additional meetings after their departure. The cell phone investigation also revealed emails with lists of customers and their contact information.
When presented with the mobile phone forensic analysis results, the owner’s feeling changed from unease to anger. He saw evidence that the pair were trying to pirate his clients, even though they had signed employment agreements containing confidentiality and 2-year non-compete clauses.
We were told to expect to be called as witnesses to testify to the forensic cellular evidence and cell phone forensic protocol we follow. The owner intended to file a lawsuit against the two men. Later the owner said that he knew he had to follow his gut instincts, even though he didn’t want to believe it. In the end, he was right.
-Brenda McGinley, CEO, All in Investigations, All in Investigations
