Case Study: Global Technology Company uncovers IP theft and secures forensic evidence with Palo Alto Networks Unit 42

A departing employee prompts an insider threat investigation for a global technology company

A large global technology company suspected that a departing employee had taken intellectual property and violated her noncompete after she returned a corporate laptop she claimed to have “wiped” a month after joining a competitor. The company engaged Unit 42 to perform an objective, forensic examination to determine whether data had been exfiltrated or deliberately destroyed.

Unit 42’s host-based forensic analysis recovered network and USB artifacts showing the laptop connected to the competitor’s network, files from the former employer (marketing templates, user guides, code reviews, rollout plans) accessed via USB, evidence of TeamViewer remote sessions, and mass file deletions and synced emails that suggested attempts to cover tracks and improper communications. Those findings provided actionable evidence of potential IP theft, unauthorized access, and contract violations, enabling the employer to pursue legal or contractual remedies.