Corporate theft happens more often than most people think, and the trail almost always lives on someone’s digital devices. The trouble is, many companies fumble the investigation before it even begins. Warren Kruse II has spent over 30 years fixing these mistakes as managing director and digital forensic expert at IDS. His work has taken him from boardroom to courtrooms and as an expert for the SEC in a spoliation hearing, but the biggest lesson he has learned is surprisingly simple.
Start With Forensically Sound Collection
You’d think that after three decades, Kruse wouldn’t have to revisit the basics. Yet his message remains consistent and essential. “After 30 years, I’m still reminding companies that it all starts with proper collection,” he says. The problem isn’t a lack of technology, but the rush to act without a plan. When companies suspect data theft, panic often leads to mistakes. They start grabbing files and copying data, overlooking the deeper evidence hidden within the operating system.
Proper collection, Kruse explains, is the key to preserving the truth. Using write blockers, a simple but powerful tool, acts like a digital seal. “This allows us to collect information without altering the data. It is literally protected and cannot be changed,” he notes. When done correctly, this step gives companies confidence that their evidence will hold up in court. Those who follow this process start their investigations on solid ground, turning a potential disaster into a case they can actually win.
Exposing the Insider Theft
Some cases stay with you, and the Comtriad investigation is one Kruse will never forget. This wasn’t a simple case of an employee walking out with files on a thumb drive. It involved trusted current employees who, while appearing loyal, were secretly running a side business built on stolen company secrets. “We reconstructed months of insider activity. These weren’t disgruntled former employees. These were active staff taking trade secrets and sending them outside the company,” he recalls. The group had even formed their own company to rebrand and sell what they had stolen. The investigation earned “Case of the Year” recognition from the High Tech Crime Investigative Association, but for Kruse, the real pride lies in the meticulous detective work that uncovered the scheme.
Building the timeline required months of detailed analysis. His team dissected every digital move the employees made in their final weeks, looking for patterns that revealed their intentions. They traced USB connections, unauthorized cloud uploads, and network activity, each digital fingerprint adding another crucial piece to the puzzle.
Translating Tech to Business Risk
Finding stolen files is only half the battle. Kruse learned early on that investigations must answer business questions, not just technical ones. “What’s the value of what they are taking? What’s the loss? What’s the legal exposure?” he asks. These questions matter because executives need to understand the real cost of theft to their company. Things get even more complex when partnerships are involved. “Do you have other companies’ intellectual property co-mingled with yours as you go to market and build something?” Kruse points out. Thieves rarely care whose secrets they take, and that can create legal headaches that stretch far beyond your own company.
The real skill, he explains, is translating technical findings into business language. Executives don’t care about file timestamps or registry entries; they want to know how much money they’ve lost and what risks they face. That’s where Kruse’s experience turns a technical report into actionable intelligence.
Having testified in countless courtrooms, Kruse knows what separates good investigations from great ones. The fundamentals of digital forensics haven’t changed much during his career, but the stakes have only grown higher. “When done right, the data tells the story, and it’s our job to present it and uncover it,” he says. His approach comes down to a simple but powerful philosophy: “Don’t just plead your case, prove it.” That mindset has guided him through SEC testimony, court appointments, and corporate investigations where millions of dollars were at stake. Companies facing intellectual property theft don’t need complex theories or expensive tools. They need investigators who know that strong forensics begins with proper collection, continues with thorough analysis, and ends with clear communication. Kruse has spent 30 years proving that when you get the basics right, the evidence speaks for itself.
Connect with Warren Kruse on LinkedIn to protect your company from digital theft before the damage is done.
