Table of Contents
- How to Preserve Access logs, device records, and download evidence in a trade secret case
- Why Digital Preservation Matters So Much In Trade Secret Litigation
- What Counts As Access Logs, Device Records, And Download Evidence?
- Access Logs
- Device Records
- Download Evidence
- When The Duty To Preserve Often Comes Into Focus
- Step 1: Identify The Likely Story Before Data Starts Disappearing
- Step 2: Stop Routine Deletion And Short-Retention Loss
- Step 3: Preserve The Right Accounts, Custodians, And Devices
- Step 4: Capture Native Files And Metadata, Not Just Screenshots
- Step 5: Use Forensic Collection Methods That Preserve Integrity
- Step 6: Preserve Cloud And Collaboration Evidence Early
- Step 7: Consider Early Court Relief If Preservation Risk Is Real
- Step 8: Document The Preservation Decisions Themselves
- Common Preservation Mistakes In Trade Secret Cases
- Waiting For A Complaint Before Preserving Key Data
- Letting Offboarding Overwrite Evidence
- Relying Only On IT Summaries
- Ignoring Personal Or Third-Party Repositories
- Failing To Protect Confidentiality During Collection
- The Bigger Strategic Point
- Short Summary
Type
Great Grandchild
Status
Approved
Caption
Title (YouTube)
Caption X
Cover
OG Image
Alt Image Text
Flat vector cover illustration showing a secure digital evidence archive connected to cloud logs, laptop and mobile device records, email and browser activity, and download artifacts, with stylized investigators preserving time-sensitive forensic data in a trade secret case.
Images
Videos
Video Published (Blog)
Publish Date (Social)
Jun 17, 2027 16:00
Scheduled (Social)
Scheduled (Social)
Images Posted (Social)
Images Failed (Social)
Videos Posted (Social)
Videos Failed (Social)
Featured
Do not index
Videos Post IDs (Social)
Created time
Apr 8, 2026 06:38 PM
Sub-item
Authors
Images Post IDs (Social)
YT Post ID
YT Embedded
Images Delete (Social)
Videos Delete (Social)
How to Preserve Access logs, device records, and download evidence in a trade secret case
Trade secret cases often turn on digital facts: who signed in, what they opened, what they copied, where they sent it, and what happened right before or after a departure, vendor dispute, or suspicious download. In many situations, the difference between a vague suspicion and a provable claim comes down to whether those records were preserved early, carefully, and in a defensible way.
That is especially true when evidence lives in places that change fast: cloud audit trails, endpoint telemetry, browser history, email headers, mobile device records, USB artifacts, collaboration platforms, and short-retention security logs. Once routine deletion, auto-rotation, device replacement, or account shutdown kicks in, key evidence can disappear. Under Federal Rule of Civil Procedure 37(e), courts look at whether electronically stored information that should have been preserved was lost because reasonable preservation steps were not taken. In general terms, that makes early evidence preservation a litigation issue, not just an IT issue.
In this post you’ll learn how companies often preserve access logs, device records, and download evidence in a trade secret case; which data sources tend to matter most; where businesses sometimes lose critical proof; and how an attorney and forensic team may help frame a preservation strategy that fits the facts. If you want broader context on how these cases arise, our overview of employee exits, vendor leaks, and emergency court requests provides the larger trade secret enforcement picture.
Scroll to the bottom for every post in this series.
Why Digital Preservation Matters So Much In Trade Secret Litigation
A trade secret claim usually involves more than the existence of confidential information. The dispute often centers on access, use, transfer, concealment, and timing. A company may already know that sensitive files existed. The harder question is often whether someone accessed them unusually, downloaded them in bulk, sent them to a personal account, synced them to cloud storage, connected removable media, or wiped traces afterward.
That is one reason federal trade secret practice often intersects with emergency relief. Under the Defend Trade Secrets Act, 18 U.S.C. § 1836, federal courts can issue injunctions, and in extraordinary circumstances may even allow an ex parte seizure process. But the statute sets a high bar: a court may grant ex parte seizure only where specific facts show, among other things, that ordinary Rule 65 relief would be inadequate and that the target would likely evade or ignore a notice-based order. The statute also requires narrow tailoring and protections for seized materials. That structure reflects how sensitive early evidence-preservation requests can become in trade secret cases.
The Federal Judicial Center’s Trade Secret Case Management Judicial Guide notes that courts often deny ex parte seizure requests where a Rule 65 order on notice appears adequate or where preservation concerns are stated in conclusory terms rather than supported by specific evidence. The same guide discusses early requests for record preservation, forensic inspection, and alternatives to seizure. In practical terms, that often means the quality of the preservation record matters from the very beginning.
What Counts As Access Logs, Device Records, And Download Evidence?
In plain English, these categories cover the digital breadcrumbs that show who did what, when, where, and from what system.
Access Logs
Access logs usually include records showing sign-ins, authentication attempts, IP addresses, device identifiers, session history, permission changes, and file or application access events. Depending on the environment, they may come from:
- Microsoft 365 or Google Workspace audit logs
- VPN logs
- Single sign-on and identity-provider logs
- File server access records
- Cloud storage activity logs
- Database query logs
- Source code repository logs
- Security information and event management systems
These records may help show unusual login times, new locations, repeated access to restricted folders, or permission escalations close in time to a resignation or vendor breakdown.
Device Records
Device records can include company laptop inventory data, endpoint detection alerts, mobile device management records, USB connection history, browser artifacts, installed apps, sync-client activity, file path history, and system metadata. In some cases, forensic imaging or targeted forensic collection may preserve these sources in a way that reduces later authenticity disputes. The National Institute of Standards and Technology’s guide on integrating forensic techniques into incident response describes forensic work as involving multiple data sources, including files, operating systems, network traffic, and applications.
Download Evidence
Download evidence can include far more than a line item labeled “download.” It may appear in:
- File access histories
- Sync logs
- Browser download artifacts
- Email attachments sent externally
- Web upload activity to personal cloud accounts
- USB mount records
- Print logs
- Screenshot or screen-capture artifacts
- Data loss prevention alerts
- Collaboration platform exports
- Native-file metadata and timestamps
Sometimes the evidence points to a direct copy event. Other times it shows a pattern: searching for client lists, opening confidential folders, plugging in a storage device, visiting a cloud-transfer site, and then deleting local traces.
When The Duty To Preserve Often Comes Into Focus
Preservation questions frequently begin before a complaint is filed. Under Rule 37(e), the inquiry turns on whether ESI “should have been preserved in the anticipation or conduct of litigation” and whether reasonable steps were taken. The Advisory Committee notes also explain that intervention in the routine operation of an information system may be part of a litigation hold when litigation is pending or reasonably anticipated. In other words, a company may not get the benefit of saying the logs vanished automatically if auto-deletion kept running after a preservation duty had become reasonably clear. See Rule 37.
In a trade secret setting, that trigger point may arise when:
- a key employee gives notice and there are signs of unusual file activity;
- an IT or security alert flags mass access or external transfers;
- a vendor relationship collapses amid concerns about retained proprietary data;
- a competitor hire raises questions tied to confidential materials;
- a company discovers evidence of account forwarding, sync activity, or device wiping;
- a demand letter is being prepared or received.
The exact timing can be disputed, which is one reason counsel often documents when concerns arose, who was notified, and what systems were placed on hold.
Step 1: Identify The Likely Story Before Data Starts Disappearing
A common early mistake is preserving “everything” in a scattered way while failing to preserve the most volatile and most telling sources. A more effective approach often starts with a case theory.
For example:
- Was the concern a bulk download before resignation?
- Was the issue vendor overreach into shared systems?
- Was there suspected cloud upload to a personal account?
- Was the concern source code access outside a normal project scope?
- Was there evidence of deletion or wiping after notice?
That story helps shape which custodians, accounts, devices, and time windows matter most. It also helps determine whether the issue is primarily about file exfiltration, unauthorized viewing, continued retention, concealment, or downstream use.
This is where outside counsel and forensic professionals often become especially valuable. They may help narrow the preservation scope to the sources most tied to the actual dispute, which can matter later when the court evaluates reasonableness and proportionality.
Step 2: Stop Routine Deletion And Short-Retention Loss
Many of the most valuable records in a trade secret case are also the easiest to lose. Identity logs may roll off after a set retention period. Endpoint tools may overwrite older events. Chat platforms may auto-delete. Cloud systems may preserve some events for only a limited time unless upgraded retention or exports are enabled.
The Rule 37 materials from Cornell’s Legal Information Institute explain that good faith may require a party to modify or suspend routine system operations when information is subject to a preservation obligation. That principle often has real consequences in a trade secret matter because security and audit systems commonly rotate data as part of ordinary operations. See Rule 37.
What this often looks like in practice:
- suspending auto-delete for relevant accounts;
- extending retention on cloud audit logs;
- preserving endpoint telemetry exports;
- locking relevant mailboxes and collaboration accounts;
- preserving security alerts and SIEM data;
- pausing device reimaging or recycling;
- preserving backups where unique evidence may exist.
The word “reasonable” does a lot of work here. Courts generally do not expect perfection, but they do look for a documented effort tailored to the dispute.
Step 3: Preserve The Right Accounts, Custodians, And Devices
Trade secret cases often involve a manageable circle of critical players, even when the enterprise is large. Early preservation usually focuses on:
- the departing or accused employee;
- direct supervisors or deal team members;
- internal IT and security personnel;
- HR personnel involved in offboarding;
- collaborators who received suspicious communications;
- outside vendors with access to protected information.
Devices and accounts may include:
- company laptops and desktops;
- company-issued phones and tablets;
- remote access logs;
- personal devices used under BYOD arrangements, where legally reachable;
- personal email or cloud accounts if there is evidence tying them to company data transfers;
- external hard drives or removable media;
- source-control and project management tools.
Control issues can get complicated quickly, especially with personal devices and third-party platforms. The Sedona Principles, Third Edition discuss proportionality and recognize that unique computer artifacts such as registry entries and log files may become important where authenticity or other specific issues are in dispute. They also emphasize that preservation burdens and benefits should be evaluated in context.
Step 4: Capture Native Files And Metadata, Not Just Screenshots
Screenshots can help explain what happened, but they are rarely the whole answer. In many trade secret cases, the important dispute is not just what a document looked like. It is whether the data reflects authentic creation, access, modification, transfer, or deletion history.
The Sedona Principles note that native or near-native production may be particularly important where header information and application metadata bear on authenticity. The same publication discusses cases in which overwritten drafts, deleted versions, log files, and other system-level evidence may be relevant. See The Sedona Principles, Third Edition.
That can matter because metadata may show:
- creation and modification timestamps;
- file ownership and path history;
- access history;
- sync-client interactions;
- document versioning;
- email routing details;
- whether a file was opened locally or via cloud services;
- whether a file appears copied or renamed.
In a close case, that kind of evidence may help distinguish ordinary job activity from suspicious pre-departure collection.
Step 5: Use Forensic Collection Methods That Preserve Integrity
Not every matter calls for full forensic imaging. In some cases, targeted collection may be enough. In others, especially where spoliation or wiping is suspected, a more formal forensic process may be more persuasive.
NIST’s forensic guidance describes effective forensic activities across data sources such as operating systems, files, applications, and network traffic. Although that guidance is not legal advice, it supports a familiar idea in litigation: evidence integrity depends on process. See NIST SP 800-86.
A defensible process often includes:
- identifying the collector;
- documenting date, time, device, and method;
- preserving originals where possible;
- generating hash values for collected data;
- maintaining chain-of-custody records;
- separating collection from substantive review where confidentiality issues exist;
- using a neutral or court-approved forensic expert where needed.
This is also where businesses sometimes create avoidable problems. Well-meaning managers may open files, browse through accounts, forward suspicious emails around the company, or “check” a laptop in ways that change timestamps and metadata. In a later evidentiary fight, that kind of casual handling can complicate authentication and spoliation arguments.
Step 6: Preserve Cloud And Collaboration Evidence Early
Modern trade secret cases frequently involve cloud ecosystems rather than one laptop with copied files. A departing employee may never plug in a USB drive at all. The activity may happen through:
- browser access to file-sharing sites;
- personal Dropbox, Google Drive, iCloud, or Box uploads;
- Slack, Teams, or other collaboration exports;
- private repositories;
- forwarded attachments in webmail;
- mobile syncing;
- ephemeral or disappearing-message apps.
That is one reason courts and agencies have paid growing attention to preservation of ephemeral and collaboration-platform data. While the context is broader than trade secret litigation, the Department of Justice and FTC have publicly emphasized preservation concerns involving ephemeral messaging and collaboration tools in investigations, reflecting a wider recognition that relevant business evidence often lives outside traditional email. See the DOJ announcement covered in the Justice Department and FTC guidance update.
For trade secret plaintiffs, cloud evidence may help show transfer paths. For defendants, the same evidence may help show innocent access, lack of dissemination, or routine work activity. Either way, short-lived cloud artifacts often become more difficult to recover as time passes.
Step 7: Consider Early Court Relief If Preservation Risk Is Real
Some cases involve genuine concern that evidence will be hidden, moved, wiped, or disseminated once notice is given. In those situations, counsel may evaluate temporary restraining orders, expedited discovery, preservation orders, forensic inspection protocols, or in rare circumstances, ex parte seizure under the DTSA.
The DTSA allows ex parte seizure only in extraordinary circumstances and only with detailed factual showings, including inadequacy of Rule 65 relief, immediate and irreparable injury, likely success, narrow identification of the property, and evidence that the target would destroy or hide the materials if given notice. It also requires the narrowest seizure necessary and places seized materials in court custody. See 18 U.S.C. § 1836.
The Federal Judicial Center’s guide indicates that courts often prefer narrower alternatives where possible, including preservation directives, noticed motions, and forensic protocols tailored to the disputed systems. See the Trade Secret Case Management Judicial Guide.
That often means the practical question is not simply “Can a company seek extraordinary relief?” but “What facts make the requested relief proportionate, specific, and credible?”
Step 8: Document The Preservation Decisions Themselves
Preservation efforts are easier to defend when the record shows what was done, when it was done, and why.
Useful documentation often includes:
- when the issue was discovered;
- when counsel became involved;
- which hold notices were issued;
- which systems had auto-delete suspended;
- which custodians and devices were identified;
- whether any devices were taken out of circulation;
- which cloud exports were run;
- whether a forensic vendor was engaged;
- what evidence could not be preserved and why.
This can matter because Rule 37(e) does not ask whether preservation was flawless. It asks whether reasonable steps were taken, whether information was lost, and whether it can be restored or replaced through additional discovery. See Rule 37.
In other words, process often becomes part of the merits landscape.
Common Preservation Mistakes In Trade Secret Cases
Several recurring issues tend to weaken early evidence positions:
Waiting For A Complaint Before Preserving Key Data
By the time suit is filed, rotating logs, wiped phones, and overwritten endpoint records may already be gone.
Letting Offboarding Overwrite Evidence
Standard offboarding may disable accounts, wipe devices, recycle laptops, and revoke cloud access in ways that also destroy useful evidence if not coordinated with counsel and forensics.
Relying Only On IT Summaries
An internal summary may be useful, but raw records, native exports, and forensic collections often carry more weight than an informal spreadsheet or screenshot deck.
Ignoring Personal Or Third-Party Repositories
The evidence trail may run through personal webmail, cloud storage, text messages, or outside collaboration platforms.
Failing To Protect Confidentiality During Collection
Trade secret plaintiffs often face a balancing problem: preserving evidence while also guarding against unnecessary disclosure of the secret itself. Protective orders, neutral experts, staged review protocols, and narrow collection scopes may all be part of that solution.
The Bigger Strategic Point
Trade secret litigation often moves fast, especially where emergency relief is in view. The first days can shape the rest of the case. A company with a clear preservation record, reliable logs, authentic metadata, and defensible forensic handling often enters that phase in a much different position than a company relying on suspicion alone.
That does not mean every unusual download proves misappropriation. It means digital evidence often determines whether a case can be explained convincingly, challenged effectively, or narrowed intelligently.
Short Summary
Preserving access logs, device records, and download evidence in a trade secret case is often about speed, precision, and defensibility. The key questions usually include when the duty to preserve came into view, which systems had the most relevant data, whether routine deletion was stopped in time, whether native files and metadata were captured, and whether the collection process can withstand later scrutiny. In many matters, an attorney working with a qualified forensic team may help assess what evidence is still available, what may already be at risk, and what kind of court intervention fits the facts.
Visit ReferU.AI to get matched with an attorney who has demonstrable experience in cases like yours — for free.
