Case study · Investigations
One Screenshot
A confidential deal strategy reached a client's competitor. The advisor responsible deleted his tracks over eight days. The devices still told the story.
- Leakage of confidential information
- Evidence destruction
- Collusion with third parties
- devices examined
- 2devices examined
- deletion window overcome
- 8 daysdeletion window overcome
- findings documented
- 5findings documented
- device-preservation standard recommended
- 24 hrsdevice-preservation standard recommended
01The situation
He uninstalled the app and deleted the chats. The evidence survived anyway.
An advisory firm held a confidential virtual strategy meeting on a live transaction. Days later, an image of that meeting surfaced with people connected to the client's competitor. An external referral advisor who attended admitted involvement when confronted.
How it came to us
A client learned that a screenshot of its confidential strategy meeting had reached people linked to a competitor.
02How it worked
- 01The advisor joined the confidential meeting from a personal laptop.
- 02He captured a screenshot of the session while it was live.
- 03He shared it through a desktop messaging application.
- 04He maintained continuous contact with one external party over the following days and searched for other deal information.
- 05Before handing over his devices, he uninstalled the messaging app and deleted chats.
Swipe sideways to see the whole diagram.
- The organisation
- Insiders involved
- Channels & documents
- Outside parties
- Where the money ended up
- Cleared / genuine
How it was hidden
Personal devices outside corporate monitoring, staged deletion, removal of the messaging app, and an eight-day gap before the devices were preserved.
03The challenge
Turn a confession into a forensically documented case, establish how the leak happened and what else was touched, despite deliberate deletion on personal devices.
What made it hard
- Deliberate anti-forensic deletion
- Personal devices requiring consent
- External contact unidentified
- Live transaction under time pressure
Red flags that were there to see
- External advisors in live deal sessions without device controls
- No screenshot prevention or watermarking
- No rapid device-preservation protocol
04Our approach
- Workstream 01
Forensic acquisition
Consent-based imaging of laptop and phone with chain of custody.
- Workstream 02
Artefact recovery
Recovered the original image and evidence of communications despite deletion.
- Workstream 03
Activity analysis
Searches, contacts and timing over the incident window.
- Workstream 04
Control gap review
How the leak was possible and how to prevent a repeat.
The breakthrough
Even after the app was removed and chats deleted, the examination recovered the original image with its capture time and evidence of sustained contact with the external party. A confession became a documented case.
05What we found & did
- The screenshot was taken on the advisor's laptop during the meeting.
- It was shared externally through a messaging application.
- Evidence was deliberately destroyed before examination.
- His contact with the external party ran through the whole period of the leak.
- Day 0Meeting; screenshot captured and shared
- Days 1–7Daily contact with external party; staged deletion
- Day 8Devices handed over and imaged
- Day 18Forensic report issued
06The impact
The firm revoked access, notified its client and preserved evidence for legal action, with recommendations for managed devices, screenshot blocking, watermarking and a 24-hour preservation protocol for confidential sessions.
- devices examined
- 2devices examined
- deletion window overcome
- 8 daysdeletion window overcome
- findings documented
- 5findings documented
- device-preservation standard recommended
- 24 hrsdevice-preservation standard recommended
07Lessons for your business
The controls that would have stopped this, or caught it sooner:
- Treat external advisors as insiders: NDAs, device standards, background checks.
- Use screenshot blocking and watermarking for deal sessions.
- Require managed devices in deal rooms.
- Preserve devices within 24 hours of a suspected leak.
~₹5 Crundue benefit quantified
The CEO's Three Vendors
A subsidiary CEO routed a rural retail rollout through vendors fronted by his own associates. The money trail led back to him.
- Procurement reconstruction
- Corporate and statutory records
- Ground intelligence
- Funds-flow tracing
US$4.7M+diversion traced to the founder
Zero Skin in the Game
An investor funded a road-construction contractor. Within months, the founder's own contribution had quietly gone to zero and the diversion had begun.
- Records digitisation
- Funds-flow reconstruction
- Personal wealth analysis
- Corporate and property records
~1Memails and documents reviewed
The Fortune That Wasn't There
Shareholders suspected their managing director of hiding a fortune. On the data available, the money trail did not support that suspicion, and it surfaced employee frauds instead.
- Digital forensics
- Source and application of funds
- Related-party mapping
- Market intelligence
Client names and identifying details are withheld to protect confidentiality. Specific references and client experiences can be shared on request, with the client’s consent.
Confidential consultation
Facing challenges at work? Speak to us, and we can help you uncover the truth.
Every matter is different. Tell us what is happening and a senior expert will advise on next steps, in strict confidence.