How do you prove trade secret theft when an employee leaves?

Employers usually know an employee took something. Proving it to the standard a court requires is a different exercise, and the window to gather what proves it is short — often measured in days after the resignation, and closed permanently the moment IT wipes the laptop for the next hire.

What has to be proved?

Under the Tennessee Uniform Trade Secrets Act the information must derive independent economic value from not being generally known, and must be the subject of reasonable efforts to maintain its secrecy. Then you must show misappropriation — acquisition by improper means, or use or disclosure by someone who knew it was improperly acquired.

The second element is where employers most often lose. A client list that was emailed around freely, stored on an open share, never marked confidential and covered by no agreement is hard to characterize as the subject of reasonable secrecy efforts. The case is frequently decided by what the company did before anyone left.

Where does the evidence actually live?

• USB and removable-device history — connections, timing, and often what was copied
• Bulk download and file-access patterns — volume spikes in the weeks before notice
• Email to personal accounts — attachments forwarded to a private address
• Cloud sync — personal Dropbox, Drive or OneDrive clients installed on a work machine
• Printing logs — still common and still overlooked
• Access outside normal hours — badge and VPN records around the departure date
• The new employer's conduct — solicitation of your clients on a timeline that only works if they had your list

What is the single most damaging mistake?

Reissuing the device. The standard IT process on a departure is to wipe and reimage the laptop, and that process destroys precisely the artefacts that would have proved the case — deleted file remnants, USB history, browser and sync records. Companies do this routinely within days, and then discover the theft weeks later when clients start leaving. The device should be pulled from service and imaged forensically before anything else happens to it.

The same applies to email accounts. Deleting or recycling a departed employee's mailbox removes the record of what they forwarded to themselves.

How soon does this need to happen?

Immediately on any resignation where the employee had access to genuinely sensitive material, and certainly before the device is reissued. Preserving is cheap; you can image a laptop and never use it. Recovering an image that no longer exists is impossible. Many employers make preservation a standing part of the offboarding process for defined roles, which removes the need to make a judgement call in the moment.

What can an investigator contribute beyond forensics?

The conduct side, which is often what demonstrates use rather than mere possession. Whether the former employee is now soliciting your clients, what they have represented about their new role, corporate filings showing a competing entity formed before departure, public professional profiles and announcements, and interviews with clients who were approached. A forensic image proves data left. The investigative work proves it was used, and use is usually what drives the remedy.