Reid's evidence
32 Fortrend alleges that the Reid Affidavit provides evidence that from mid-October 2022, Wollermann and Lyle at different times connected a number of USB drives to their desktops. Those devices are referred to as the:
(a) SanDisk Cruzer;
(b) USB 2;
(c) Lexar Firefly;
(d) WD Passport; and
(e) as well as three other USB devices with the serial numbers: "04009522050121083042", "20120926571200000", and "4C530001430603113515", respectively,
(collectively, the USBs).
33 Fortrend alleges that none of the USBs are in its possession, nor were they known about by Mr Forster prior to Mr Reid's involvement. The Reid Affidavit explains that one or more of the USBs were connected to Wollermann and Lyle's desktop computers on at least eight occasions between late October 2022 and the date of Lyle and Wollermann's resignation. On each occasion the USBs were connected (often multiple USBs at once), there were often dozens of interactions that followed which is indicative of the Confidential Information being saved onto the USBs.
34 The Reid Affidavit deposes to Mr Reid's forensic analysis, to date, of the Devices that he was provided with, including:
(a) Apple iPhone 11 Pro model A2215 with serial number C39D25MCN6Y6 (Wollermann Phone);
(b) HP Pavilion desktop computer model 570-p059a with serial number CNV74510SG (Wollermann Desktop). ]Apple iPhone 11 Pro model A2215 with serial number C39D2187N6Y6 (Lyle Phone, together with the Wollermann Phone, the Phones);
(c) Lenovo ThinkCentre desktop computer model M73 with serial number PB00MX0G (Lyle Desktop, together with the Wollermann Desktop, the Desktops); and
(d) Dell lnspiron 3563 laptop with service tag 20D7X23 (Lyle Laptop).
35 Mr Reid's evidence reveals the following:
(a) It is likely that the Phones were wiped and reset to their original settings and activated for a new user (a process which would delete all previous user data, including emails, text messages, call history and the address book). Based on data extracted from the phones this is likely to have occurred on or shortly before:
(i) 18 November 2022 for the Lyle Phone; and
(ii) 1 December 2022 for the Wollermann Phone.
(b) In relation to the Lyle Laptop, it is likely that on or about 16 November 2022, the Windows operating system was reset to factory defaults, a process which would delete user activity, internet history, event logs, user documents and locally stored emails. Mr Reid to date has not identified any records relevant to the scope of his engagement and there is a paucity of user records or activity, both of which are consistent with limited usage of the Lyle Laptop subsequent to the reset process.
(c) In relation to the Desktops, between 20 September 2022 and 18 November 2022, interactions occurred on the Desktops that are consistent with documents being downloaded or saved from the Desktops and/or the FSA network share drives ("F-Drive" and "G-Drive") to USB thumb drives or portable hard drives. This conclusion is supported by Mr Reid's findings that:
(i) there are records of zip archive files being saved or created on a USB device, and whose titles appear to relate to FSA client accounts;
(ii) there is a characteristic and repeated pattern of USB device connection and disconnection activity bracketing interactions with folders on the FSA F-Drive network share, and folders which appear to be located on USB devices;
(iii) there are recorded interactions with folders on USB devices with titles which appear to correspond to equivalent folders on the FSA F-Drive network share, and which Mr Reid understands are named for FSA client accounts;
(iv) there are recorded Windows event logs indicating the viewing or editing of Excel documents at times proximate to records of USB device connection and disconnection;
(v) the number of recovered USB-related events recorded over October and November 2022 in connection with the Wollermann Desktop, account for 92% of all USB-related events for that year, while the corresponding events on the Lyle Desktop, account for 80.85% of all USB-related events for that year; and
(vi) the number of recovered folder interactions recorded over October and November 2022 in connection with the Wollermann Desktop, account for 89.8% of such events for that year. This metric is less pronounced for the Lyle Desktop, with these months accounting for around 33% of activity for that year.
(d) In relation to the Wollermann Desktop, there are internet history records which suggest that between May and November 2022, there was:
(i) access to folders within the FSA G-Drive network share, which Mr Forster has said Mr Wollermann was not authorised to access;
(ii) access to the "Box" cloud storage service for Fortrend Securities Inc (a company related to Fortrend), which Mr Forster has said that Mr Wollermann was not authorised to access. Box is a cloud-based file sharing and content management service that allows users to access, store, and share files and folders online.
(e) In relation to the Wollermann Desktop there are internet history records which show that in November 2022 there were enquiries made around the merging or consolidation of contact information from the Exchange application on an iPhone with an Apple iCloud account.
36 The Reid Affidavit deposes to search activity which Lyle undertook on the Lyle Phone on 22 November 2022 between 5:58 pm and 6:05 pm. The search history indicates that Mr Lyle accessed Microsoft Outlook through the Safari internet browser rather than through the dedicated Outlook email application, which was not installed on the Lyle Phone. The Reid Affidavit explains that emails or other data input through Outlook online in Safari would not be saved as files on the device itself, but in the Microsoft cloud for the specific user.
37 Mr Reid deposed to undertaking a forensic analysis of the hard drive contained in the Lyle Laptop using forensic analysis programs "Magnet Axiom" and "USB Detective". That analysis revealed that the Windows 10 home operating system present on the hard drive from the Lyle Laptop was recorded as being installed on 17 November 2022 (the day after Lyle gave his notice of resignation). Mr Reid deposed that he was not able to identify any significant user activity in terms of USB connectivity, file or folder access, or internet history on the Lyle Laptop. Mr Reid expressed this opinion based on the recorded Windows installation date, along with the absence of records showing significant user activity, and the content of log files relating to the Windows installation process. Mr Reid's evidence was that it is likely that the Lyle Laptop was reset to its factory settings on 16 November 2022, with the re-installation and setup completed on 17 November 2022. This had the effect of deleting all previous user data.
38 Mr Reid then undertook an analysis of the Desktops and the interactions the Desktops had with the USBs and other devices. Mr Reid gave evidence that on 18 November 2022 files and folders were accessed and copied from either the Wollermann Desktop or the Fortrend F-Drive network and shared to the Lexar Firefly and WED Passport devices.
39 Mr Reid also undertook analysis on the interactions of the Wollermann Desktop and Lyle Desktop on various dates between 20 September 2022 and 18 November 2022 and concluded that there is evidence that the Fortrend server was accessed and documents were accessed and saved onto the Lexar Firefly. Mr Reid also deposes to a similar process occurring, wherein documents were saved onto the SanDisk Cruzer.
40 Mr Reid, in his expert evidence deposed to internet searches being conducted on the Wollermann Desktop on 10 November 2022, wherein certain URL links were accessed which were consistent with someone saving the contact list from the Outlook application on an iPhone to a separate Apple iCloud account, and on that same day, Wollermann conducted internet searches on how to back up his iPhone contacts to his personal Gmail account.
41 Fortrend alleges that the evidence of Mr Reid and Mr Forster, in respect of the USBs, supports the conclusions that:
(a) at least 50 individual client folders were accessed and downloaded onto the USBs, often saved with the name "NEW ACCOUNTS DOCUMENTS";
(b) personal employment folders of employees other than Wollermann and Lyle, including the entire G-Drive, were accessed and downloaded onto the USBs;
(c) client summary files of all FSA Clients from StoneX were downloaded onto the USBs; and
(d) files were saved onto the USBs which are no longer in Fortrend's possession, and which have suspicious names such as "Template", "Primary Offerings 11.14.22.xlsx" and "Proposed CDs".
42 Fortrend alleges that the evidence discloses that the Confidential Information, in particular, client contact information and account details, was appropriated by Wollermann and Lyle, provided to Shaw, and used by Shaw to solicit FSA Clients.
43 Fortrend alleges that the evidence discloses that Wollermann and Lyle made undisclosed and unauthorised copies of the Confidential Information on personal USBs, denied having retained that material, but then Shaw prepared Welcome Letters and ACATS which could only have been prepared if Shaw had the Confidential Information.