Raleigh, North Carolina
Digital Forensics Raleigh, North Carolina | Research Triangle Matters
The Triangle's technology, biotech, and university employers, along with state government, produce disputes about who had access to what data and what they did with it.
Talk Through a MatterWake County and the Triangle
Where engineers, researchers, and agency staff change jobs often.
When talent moves between employers in a research-heavy region, questions follow about code, protocols, and datasets. The evidence sits in repositories, cloud storage, laptops, and messaging tools. Reading it takes patience: a download is not a theft, and an upload is not an exfiltration, until the surrounding context says so.
Rune Forensics helps counsel read that context. The practice reconstructs activity around a departure, identifies what moved and where, and reports what the logs support. It also works with defense attorneys on independent review of phone and computer evidence.
Who the work suits
Intellectual property and employment litigators, counsel to technology and life-science companies, attorneys handling state matters, and defense counsel.
Common points of dispute
Repository and cloud downloads before a resignation, personal devices used for work, and whether a log shows access, copying, or only viewing.
Focus
Data movement and device evidence.
- Code repository and cloud-drive activity analysis
- Laptop, external storage, and sync review
- Departing employee investigation
- Phone and message examination
- Independent review of law enforcement and expert reports
Steps
Contain, reconstruct, explain.
Contain the evidence
Systems are snapshotted and logs exported before routine cleanup.
Reconstruct
File and account activity is ordered into a defensible timeline.
Matter types
Technology, employment, and defense matters in the Triangle.
Raleigh matter types
- Intellectual property and trade secrets
- Employee departures
- State agency and employment matters
- Criminal defense
- Insurance
FAQ
Common questions about Triangle cases.
Can a log show whether a file was copied or just opened?
Depending on the system and logging level, sometimes. The report states which actions the available records distinguish and which they cannot.
Does a personal device used for work complicate things?
Yes, for scope and for privacy. Counsel and the practice work out what can properly be examined.
How do you handle open-source and shared code?
By examining repository history and access records to show who did what, while leaving questions of ownership to counsel.
Reach out
Tell us what moved and who had access.
A summary of the dispute, the systems involved, and the dates is enough to begin.
Pages that apply: business forensics and email compromise, computer forensics, and independent forensic review.
Send a Message