The situation
A global technology manufacturer discovered slides from its confidential product roadmap posted on a popular enthusiast forum, six weeks before a planned launch. The post came from a newly created account and included three screenshots of the roadmap. Within a day the images had been copied to news aggregators and video channels, and the company's launch plans were being picked apart in public.
The company's outside counsel engaged us to find the source. Our instructions were explicit: stay strictly within public information and records the company already lawfully held under its own policies.
The question
Who posted the material, and how did they obtain it? Counsel also needed to know whether this was a one-off disclosure or part of a pattern, and whether anyone else inside the company was involved.
What we did
A lead investigator, an image analyst and a linguistic analyst worked the case, with a red-team reviewer assigned from the start. All communication ran through counsel so that our work product remained privileged.
1. Preserved before anything else
Forum posts get deleted, and this one was. Within two hours of tasking we had captured the thread, the account profile and every image at full resolution, each timestamped and hashed, along with 41 copies reposted elsewhere. The original post disappeared 14 hours after it was published. Our preserved copy became the primary evidence.
2. Read the screenshots like evidence
The images were screenshots, not photographs of a screen, and screenshots carry the fingerprints of the machine that took them. By measuring interface elements against their known native sizes, the image analyst established a display scaling factor of 125 percent. The window frame showed a dark interface theme and a regional date format. And at the edge of one image, a partially visible calendar reminder showed the first nine characters of a meeting title and an on-screen clock reading 23:52.
3. Narrowed with the client's own records
Counsel provided the list of 340 employees and contractors with access to the roadmap folder and, under the company's existing IT policy, configuration records for its managed laptops. Only 38 people used 125 percent scaling with the dark theme. The truncated meeting title matched a recurring meeting series attended by 6 of those 38.
4. Studied the poster's public behavior
The forum account posted four times, always between 23:10 and 01:40 local time. Its writing combined a distinctive set of habits: one regional spelling convention paired with another region's date order, two spaces after every full stop and a recurring misspelling of an internal product codename. We compared these markers against the public posting history of the forum's established users and found an older account, active for six years, with the same habits and the same late-night posting window.
5. Connected the older account
Years earlier, the older account had linked to a personal portfolio website. That site, still public, carried the name of one of the six people on the shortlist: a contractor working with the product team.
6. Tested it against the logs
With counsel's approval, the client checked its document access logs for the night of the on-screen clock. The contractor had opened the roadmap file at 23:47, five minutes before the time shown in the screenshot. No one else on the shortlist had accessed it that week.
The red-team reviewer then tested the obvious objection: could someone have imitated the contractor's writing to frame them? The six-year history of the older account predated both the leak and the contractor's engagement with the company, which made deliberate imitation implausible.
| Filter applied | Source | Remaining |
|---|---|---|
| Access to the roadmap folder | Client access list | 340 |
| 125 percent scaling and dark theme | Screenshot analysis, device records | 38 |
| Attends the meeting series in the screenshot | Screenshot analysis, calendar records | 6 |
| Writing habits match a long-standing public account | Public forum history, portfolio site | 1 |
| File opened five minutes before the on-screen clock | Client access logs | 1, confirmed |
What we found
- High confidence: the forum post and screenshots were made by the contractor.
- High confidence: the screenshots were taken on the contractor's managed laptop on the night in question.
- Moderate confidence: the disclosure was a single, unsolicited act rather than part of a pattern. We found no evidence of payment, no contact with competitors or media and no indication that anyone else was involved.
We did not access the contractor's personal accounts or devices, create accounts to engage the poster or contact anyone involved. Every conclusion rested on public posts and on records the company already held under its own policies, combined under the direction of counsel.
The outcome
Counsel received our report on day nine. When interviewed by the company's human resources and legal teams, the contractor admitted posting the material.
- The contractor's engagement was ended and no litigation was required.
- Remaining copies of the slides were removed after counsel's notices to the hosting sites.
- The company tightened access to roadmap material and introduced per-user document watermarking.
What made the difference
On their own, the public evidence pointed to an anonymous account and the internal records pointed to 340 people. Combining them lawfully, under counsel's direction, produced an answer neither could reach alone.
Speed of preservation mattered just as much. Had we started a day later, the original post and its full-resolution images would have been gone, and with them the scaling measurements and the on-screen clock that made the case.