When a former partner, a former employee or a competitor takes what is not theirs, the dispute is decided by dates, accesses and files. The examination shows what left, through which channel, when and where it ended up.
Source code, firmware, customer databases, marketing campaigns, the visual identity of a product: almost every intellectual asset of a company exists today as a file, a system or an online account. When it is copied or diverted, the traces stay in those same places.
That is why intellectual property enters digital law whenever the disputed object is technological. The legal question is whether there was infringement or unfair competition. The answer depends on technical facts: who accessed, what was copied, when, through which channel and where it was taken.
The examination establishes those facts with the method of computer forensics: preservation before any analysis, hash, chain of custody and conclusions limited to what the evidence supports. It serves those whose asset was taken and also those accused of copying. Trademark and patent registration is a matter for the INPI (Brazil's patent and trademark office) and the lawyers.
Comparison between code bases, including the firmware of devices: identical passages, structure, names, comments and even errors that repeat. The examination separates the origin of each layer: in-house code, third-party libraries, open source. And it distinguishes copying from the similarity imposed by the program's function, which the Software Act does not treat as an infringement (Law 9,609/1998, the Brazilian Software Act, art. 6º, III).
Designs, technical documentation, price tables and customer lists. The examination shows that the information was restricted, who had access, what was copied and through which channel it left: USB drive, personal cloud, private e-mail or personal device connected to the company network.
Every database carries its own marks: internal codes, spellings and fields that nobody would type the same way by chance. Checked against the material found on the other side, those marks tie the data to their origin and rule out the coincidence theory.
Trade dress is the visual whole that identifies a product: packaging, colours, shape, layout of the sales page. The examination compares logo, products, pages, advertisements and marketing plan, and dates each version with metadata, domain registration and archived pages, to show who came first. The conclusion on consumer confusion is a legal one.
Advertising accounts, A/B tests, audiences and keywords are also company assets. The examination looks at who accessed those accounts, from where and what changed in each campaign, and shows when the marketing management began working against its own client.
The Industrial Property Act treats as a crime of unfair competition the use of fraudulent means to divert another's clientele (Law 9,279/1996, the Brazilian Industrial Property Act, LPI, art. 195, III). It treats in the same way the unauthorised use of confidential information obtained through a contractual or employment relationship, even after the contract ends, or obtained by unlawful means or fraud (LPI, art. 195, XI and XII). Information in the public domain and information evident to a person skilled in the field are left out. That is why the examination must show more than the copy: it must show that the information was restricted.
In the civil sphere, the injured party may act independently of the criminal action (LPI, art. 207). The law also preserves damages for acts of unfair competition it does not list, when they tend to harm another's business or to create confusion between establishments or products (LPI, art. 209). That is the ground on which trade dress usually comes in. Computer programs, in turn, are protected as copyright, without depending on registration (Law 9,609/1998, art. 2º, caput and §3º).
Calculating the damage is the work of an accounting expert. The digital examination delivers the dated facts that feed that calculation: what was diverted, since when and through which channel.
In an intellectual property dispute, the evidence is almost always with the other party. Notifying before preserving gives time to delete. Inside the company, the first step is a litigation hold on the e-mails, repositories, accounts and equipment of whoever left.
The CPC (Brazilian Code of Civil Procedure) allows early production of evidence when there is a well-founded fear that verifying the facts may become impossible or very difficult (art. 381). The examination prepares the technical part of the application: what to collect, from which equipment and accounts, and under which protocol.
In cases of copyright infringement of a computer program, search and seizure is preceded by an inspection (Law 9,609/1998, art. 13 and art. 14, §3º). The expert in charge proposes the collection protocol to the court and accompanies the proceedings, so that the copy comes out intact, with hash and chain of custody.
When confidential information is submitted to the court, the Software Act requires the judge to order that the proceedings be sealed (Law 9,609/1998, art. 14, §4º). The report separates the code and the sensitive data into a dedicated annex.
A company created a physical product and sold it through its online shop. The owner of the agency that handled its marketing saw the product's potential, set up a competitor and began selling cheaper replicas. He stayed in charge of the client's marketing. The A/B tests (comparing two versions of an advertisement to see which performs better) ran on her site, and the best results went to his. Her advertisements were altered to bring in fewer and fewer visits. The shop's customer databases were also exported.
The examination cross-checked the account accesses with IP address and source network, validated e-mails through the sending domain's digital signature (DKIM) and examined the transcript of a meeting. It dated the domain and the first versions of the competing website and compared the logos and products of the two companies.
The report assembled, in chronological order and with dated evidence, the priority of the client's product, the copying, the export of the databases and the use of the marketing contract itself against her.
Confidential data were reaching a competitor, and suspicion fell on an employee who used his own device, out of the company's reach.
The corporate network traffic logs showed the recurring outflow of the files and supported the search and seizure of the device.
The court-ordered examination confirmed the data on the device and the handover to the competitor. The full version is in Corporate Investigations and Compliance. There is another case of a diverted customer database on the Representative Cases page.
See also
Software and Development Project Forensics → Corporate Investigations and Compliance → Computer Forensics and Digital Investigation → Judicial and Extrajudicial Expert Work → Digital Law and Technology → Antitrust → Representative Cases →
Before deciding, it is worth seeing what has already come through this laboratory: cases described without identifying the parties, in the format of challenge, method and result.
The intruder's control channel was written into smart contracts. The examination decoded what he had deleted and handed the authorities concrete routes to identification.
See the case Negative proofThe official examination had concluded that he took part. The re-examination showed the links were false positives, and the accused person was cleared.
See the case