September 29, 2026
The First 72 Hours After You Discover Misappropriation

This is the third post in Certum Group's seven-part series bringing our Trade Secret Litigation Playbook to the blog. It draws on Part III of the Playbook, Before You File. Read or download the full Playbook here.
The call usually comes from a sales leader, a head of engineering, or a chief of staff, and it usually starts the same way: "We think someone took X, and we think they took it to Y." What happens in the next three days is disproportionately important. The most expensive mistake in trade secret practice is waiting — every week that passes lets the defendant commercialize your advantage, and worse, lets the evidence quietly disappear. Slack messages, badge records, and git histories often sit behind auto-delete settings as short as ninety days. So before you do anything else, move to preserve. Here is what good early triage looks like.
Issue a litigation hold — in writing, within 24 hours
A written instruction to preserve any document, chat, email, calendar, or file relating to the possible misappropriation, sent to the full legal, HR, IT, and leadership teams. It should be specific enough to be useful, broad enough to catch the unexpected, and documented enough that you can produce it later. This is the single most important thing you can do in the first day.
Lock down forensic images — and don't let internal IT do it
Laptops, phones, and company devices belonging to any suspected party should be forensically imaged by an outside forensics firm, not wiped or "checked" by internal IT. Chain of custody matters, and internal teams generally cannot testify to it at trial. The right instinct is to image broadly and review narrowly: you can always decline to look at a device you preserved, but you can never go back for one that was reissued, wiped, or sold. And don't forget the non-obvious sources — personal cloud drives, USB connection histories, printer spooler logs, and screen-capture utilities are often where the decisive evidence actually lives.
Extend retention on cloud and platform logs
Have IT extend retention on the relevant accounts and export the log data — access logs, download histories, egress traffic — before anything rolls off. The forensic story of who did what, when, and with which file is usually more persuasive to a judge than any human witness. A download at 11:47 p.m. the night before a resignation is powerful evidence because of what the timing means.
Do not tip off the adversary
Resist the urge to confront the suspected employee, their new employer, or their counsel. Confrontation at this stage tends to accelerate deletion and pull communications behind privilege claims. A carefully timed cease-and-desist letter, sent after preservation is secure, is a very different move — and a far more effective one.
Investigate under privilege
Any investigation you run should be conducted under attorney direction, so that the work product is privileged and your witness interviews do not become admissions used against you later. This is not about secrecy for its own sake. It is about making sure the investigation helps your case rather than becoming evidence in it.
Consider — but do not rush — the early public filing
Ex parte seizure orders, temporary restraining orders, and preliminary injunctions all have their place, and an early injunction can be the single most valuable outcome in the whole case.1 But these motions require a level of evidentiary support you rarely have on day three. It is almost always better to spend a week building the record than to file fast and lose the first motion, which hands the defendant a narrative and hands you a hole to climb out of.
The triage checklist
If you want a single page to keep by the phone, it looks like this: litigation hold issued in writing within 24 hours; outside forensics firm retained and imaging scheduled; cloud and platform log retention extended; a list of suspected individuals plus their managers and peers; a list of the specific secrets that may have been taken; copies of every NDA, employment agreement, and IP assignment covering them; a review of the last 90 days of their calendar for unusual patterns; and outside trade secret counsel engaged under privilege.
Do the first 72 hours well and you preserve every option that follows — injunction, damages, settlement leverage. Do them poorly and you may spend the next two years litigating around evidence you could have saved in an afternoon. If you are in the opening days of a matter and want a fast, confidential read on what to do now versus later, that is exactly the conversation we have most often.
Go deeper with the Playbook.
This post covers one piece of a much larger picture. For the full framework — what the law requires, what a strong pre-filing case looks like, how damages experts value these matters, how counsel fee structures change your economics, and how litigation finance fits in — read Certum Group's Trade Secret Litigation Playbook, our field guide for business owners and the counsel who advise them: certumgroup.com/the-trade-secret-playbook.
And if you are evaluating a live dispute — or simply want to pressure-test what a matter is worth and how it might be funded — get in touch. A confidential conversation with Certum is free and carries no obligation, whether or not you ultimately seek funding. Reach us at certumgroup.com/contact-us.
Sources
1. The ex parte seizure procedure is authorized by the Defend Trade Secrets Act, 18 U.S.C. Section 1836(b)(2), and is available only in extraordinary circumstances.
Recent Content



