For engineering organizations, source-code theft via Git is the most common form of trade-secret exfiltration and one of the easier to document forensically. Git itself creates a rich audit trail.
The artifacts:
Repository clone events. GitHub Enterprise, GitLab, Bitbucket, and Azure DevOps all log clone events with user, timestamp, IP address, and repository identifier. Audit logs are typically retained for months or years.
Local clone artifacts on the departing employee's device. Even if the cloud-side logs are missing, the local Git folders themselves preserve the clone history, including the remote URL, the branch state, and the timestamp of last sync.
Fork patterns. Employees rarely clone-and-leave; they often fork to personal accounts first, then clone the fork. The fork itself is an evidentiary artifact and is often visible in the GitHub Enterprise audit log even after the fork is deleted.
Push patterns to non-corporate remotes. If the employee pushed code to a personal GitHub or to a competitor's repository, those push events are visible in both the source and destination logs and in the local Git reflog.
Authentication-token artifacts. Personal access tokens, SSH keys, and OAuth credentials used during exfiltration leave their own forensic trail.
For counsel: engineering organizations have unusually complete Git-side audit data. The work is interpreting it correctly and producing it in a form that holds up under technical cross-examination.