Sin Soon Hock Sdn. Bhd. v Lim Soo Aun (PA-22NCvC-147-08/2021)

The Plaintiff also relies on DW2’s own findings concerning the existence of 2,511 LNK files recovered from the laptop. These artefacts constitute evidence of substantial prior usage and the existence of company data that had previously been stored on the device. Notwithstanding their significance, DW2 failed to conduct any meaningful analysis of these artefacts. The Plaintiff therefore submits that an adverse inference ought to be drawn pursuant to section 114(g) of the Evidence Act 1950, as such evidence would have been material in establishing the extent of the deleted data. [15] As regards the chain of custody, the Plaintiff submits that the evidence demonstrates a continuous and properly documented custody trail from the time the laptop was returned, through its storage by the Plaintiff’s IT personnel, subsequent police custody, and the various forensic examinations conducted thereafter. There is no evidence whatsoever of any tampering, interference, or interruption in that chain. In any event, the Defendant’s challenge to the chain of custody is immaterial, as the critical event, namely the factory reset and deletion of data, had already occurred prior to the laptop being returned to the Plaintiff. [16] The Plaintiff further submits that little weight should be accorded to the evidence of DW2. His reports were prepared primarily as rebuttal reports and his conduct during the proceedings demonstrated a lack of independence and objectivity expected of an expert witness. Similarly, DW1’s testimony was internally inconsistent, particularly regarding access to the Plaintiff’s server systems, thereby undermining his overall credibility. [17] The Defendant’s reliance on limitation, laches, and acquiescence is equally without merit. The Plaintiff only obtained forensic confirmation of the factory reset and deletion of data on 11 April 2021, and the present 8 action was commenced well within the applicable statutory limitation period. There has been no unreasonable delay, prejudice, waiver, acquiescence, or conduct capable of defeating the Plaintiff’s claim. [18] Likewise, the doctrines of res judicata and duplicity do not arise. Neither the proceedings before the Industrial Court nor the Judicial Review proceedings addressed or determined the issues presently before this Court, namely the deletion of company data, the factory reset of the laptop, and the Defendant’s liability arising therefrom. The present action is founded on negligence, breach of duty, and breach of confidentiality, which are entirely distinct from the issues concerning the Defendant’s dismissal. The mere existence of overlapping facts does not render the present proceedings duplicative or barred. [19] In relation to damages, the Plaintiff submits that the appropriate course is for damages to be assessed separately pursuant to Order 37 Rule 1 of the Rules of Court 2012. The quantification of loss will require detailed forensic, technical, and documentary evaluation, which is distinct from the issue of liability presently before the Court. [20] In summary, the Plaintiff submitted that the forensic and factual evidence overwhelmingly establishes that the laptop was factory reset on 27 March 2018 whilst it remained under the Defendant’s custody and control, resulting in the deletion of the Plaintiff’s company data. There is no credible evidence of any post-handover tampering or interference. The evidence of the Defendant’s witnesses is speculative, inconsistent, and unreliable, whereas the evidence of PW6 remains cogent, consistent, and materially unchallenged.

Accordingly, the Plaintiff respectfully prays for judgment to be entered in its favour, with damages to be assessed separately, together with costs and such further relief as this Court deems fit and proper. G. DEFENDANT SUBMISSIONS [22] The Defendant respectfully submits that the Plaintiff has failed to discharge its burden of proving, on a balance of probabilities, that the Defendant performed the alleged factory reset of the laptop or deleted any company data. At its core, the Plaintiff’s case rests almost exclusively on the forensic opinion of PW6. However, PW6’s conclusions are neither conclusive nor reliable, being founded upon assumptions and an incomplete forensic analysis that failed to adequately address material issues affecting the integrity of the evidence. [23] During cross-examination, PW6 acknowledged significant limitations in his investigation, including uncertainty regarding the security and integrity of the relevant system logs. More importantly, PW6 failed to satisfactorily address the possibility of system time manipulation and other forensic concerns identified by the Defendant’s expert witness, DW2. In contrast, DW2 conducted a detailed analysis of the device and identified numerous forensic irregularities that cast serious doubt on the reliability of the Plaintiff’s conclusions. These included the use of recovery tools, changes to the hard disk environment, system alterations, and other indicators suggesting that the forensic artefacts relied upon by the Plaintiff may have been compromised or affected after the laptop left the Defendant’s possession. [24] The Defendant further submits that the Plaintiff has failed to establish a reliable and unbroken chain of custody in respect of the laptop. The evidence reveals material gaps in documentation, inconsistencies regarding the handling of the device, and a failure to comply with 10 established forensic preservation standards. Such deficiencies are particularly significant in a case that depends almost entirely upon digital evidence. Given the possibility of post-return access and interference, the Plaintiff cannot establish with any degree of certainty that the forensic state of the laptop examined by its experts accurately reflected the condition of the device at the time it was returned by the Defendant. Consequently, the forensic findings relied upon by the Plaintiff are unsafe and ought not to be accorded substantial weight. [25] Even if the Court were to accept that a factory reset had occurred, which is denied, the Plaintiff has nevertheless failed to prove that the Defendant was responsible for it. The Plaintiff’s case relies entirely upon inference and speculation rather than direct evidence. There is no contemporaneous evidence, forensic artefact, witness testimony, or admission linking the Defendant to the alleged deletion of data. The mere fact that the laptop was at one time in the Defendant’s possession does not relieve the Plaintiff of its obligation to prove, through credible evidence, that the Defendant committed the acts alleged. [26] The Defendant further submits that the Plaintiff’s attempt to characterise its claim as one founded upon negligence, breach of fiduciary duty, or breach of confidentiality cannot overcome these fundamental evidential deficiencies. Regardless of the legal label attached to the cause of action, the Plaintiff remains obligated to establish breach, causation, and resulting loss. Having failed to prove that the Defendant deleted any data or reset the laptop, the Plaintiff’s claims necessarily fail at the threshold stage. [37] In addition, the Defendant submits that the present action is barred by the doctrines of res judicata and issue estoppel. The substance of the Plaintiff’s complaint concerning the alleged deletion of data and the 11 circumstances surrounding the return of the laptop formed part of the disputes litigated in earlier proceedings between the parties. The Plaintiff is now attempting to revisit substantially the same factual issues under a different legal characterisation. The law does not permit a party to re-litigate matters which have already been determined or which ought properly to have been raised in earlier proceedings. To permit the present action to proceed would undermine the principle of finality in litigation and amount to an abuse of the Court’s process. [28] The Defendant further contends that the Plaintiff’s claim is affected by delay, laches, and acquiescence. The Plaintiff was aware as early as April 2018 that the laptop had allegedly been factory reset. Despite such knowledge, the Plaintiff chose not to obtain or present the necessary forensic evidence during the earlier proceedings. Instead, the Plaintiff only pursued the present forensic investigations after the Industrial Court delivered an adverse award in March 2021. This sequence of events strongly suggests that the present proceedings constitute a belated attempt to remedy evidential shortcomings that existed in the earlier litigation. Such delay is both unreasonable and prejudicial and supports the inference that the Plaintiff acquiesced in the state of affairs about which it now complains. [29] The Defendant also submits that the Plaintiff has wholly failed to prove damages. No specific data alleged to have been deleted has been identified with precision, no actual financial loss has been demonstrated, and no credible evidence has been adduced to quantify any alleged damage suffered. The Plaintiff’s claim therefore remains entirely speculative. Its request for damages to be assessed at a later stage is equally misconceived. There is neither a pleaded basis, agreement between the parties, nor any exceptional circumstance justifying 12 bifurcation of liability and damages. Established authorities make clear that a plaintiff must first prove the existence of recoverable loss before an assessment of damages can arise. [30] Viewed in its totality, the Defendant submitted that the Plaintiff’s case is built upon conjecture rather than proof. The forensic evidence relied upon is disputed and unreliable, the chain of custody is compromised, causation has not been established, and no actual loss has been proven. By contrast, the evidence of DW1 and DW2 is credible, internally consistent, and raises substantial doubt regarding the Plaintiff’s theory of the case. [31] Accordingly, the Defendant submits that the Plaintiff has failed to prove liability, breach of duty, causation, or damages on a balance of probabilities. The claim is further barred by the doctrines of res judicata and issue estoppel and is, in any event, defeated by the Plaintiff’s delay and evidential shortcomings. The Plaintiff’s claim should therefore be dismissed in its entirety with costs. H. ANALYSIS AND FINDINGS [32] Having considered the pleadings, evidence, expert reports, and submissions of both parties, I make the following findings based on the issues put forth by the parties. [33] The central issue is whether the Plaintiff has proven, on a balance of probabilities that the Defendant caused the company-issued laptop to be reset to factory settings on 27 March 2018, resulting in deletion of company data. [34] The Plaintiff relies on contractual obligations under the Defendant’s appointment letter, as well as implied duties of fidelity, confidentiality, and fiduciary obligations arising from his position as Chief Financial Officer. Reliance is placed on FP Stencil Sdn Bhd v Ng Siew Phei [2025] 11 CLJ 615, Karen Yap Chew Ling v Binary Group Services Bhd & Another Appeal [2023] 7 CLJ 534 (CA), Bristol and West Building Society v Mothew [1998] CH 1; Gurbachan Singh Bagawan Singh & Ors v. Vellasamy Pennusamy & Other Appeals [2015] 1 CLJ 719 (FC); Gurbachan Singh Bagawan Singh & Anor v. Vellasamy Pennusamy & Ors And Other Applications [2012] 2 CLJ 663 (FC); Vellasamy Pennusamy & Ors v. Gurbachan Singh Bagawan Singh & Ors [2012] 2 CLJ 712 (CA); Vellasamy Ponnusamy & Ors v. Gurbachan Singh Bagawan Singh & Ors [2006] 1 CLJ 805. [35] The Defendant, however, denies liability and challenges the reliability of the forensic evidence. Reliance is placed on general principles requiring independent expert evidence, Indadi Utama (M) Sdn Bhd v Kwah Peng Kun [2025] CLJU 1682 on failure to prove wrongful deletion and ownership of data, and Asia Commercial Finance (M) Bhd v Kawal Teliti Sdn Bhd [1995] 3 CLJ 783 on res judicata and issue estoppel. The Defendant further contends that ISO forensic standards were not complied with and that chain of custody was broken. The Plaintiff however relies on Ho Hup Construction Co Bhd v Woo Thin Choy [2015] 9 CLJ 706 (CA) on shifting evidential burden and submits that no delay, laches, or acquiescence arises. [36] It is a fundamental principle of civil litigation that the legal burden of proof rests continuously on the party who asserts a fact, as mandated by Section 101 of the Evidence Act 1950. [37] In this case, the Plaintiff must prove on a balance of probabilities that: [a] The factory reset occurred at a specific time when the laptop was in the sole custody and control of the Defendant; and [b] The Defendant was the operating mind who initiated that reset. [38] To discharge this heavy burden, the Plaintiff relies primarily on the digital forensic report and oral testimony of PW6. The Defendant strongly resists the claim and challenges the Plaintiff’s technical findings through the rebuttal expert testimony of DW2, as well as DW1 own testimony. CHRONOLOGICAL ANCHOR: TIMELINE OF ALLEGATION [39] The Plaintiff’s case stands or falls on a single chronological anchor: establishing that the factory reset was executed and completed on 27 March 2018 at 00:36 (Local Time). Since the Defendant admits he held physical possession of the machine on that date, the Plaintiff argues that causation is established through an inference of proximity and custody. [40] To substantiate this exact timestamp, PW6 pointed to the creation date of the Windows system primary "User Folder" and subsequent automatic internet time synchronizations recorded on 3 April 2018 when the laptop was connected to an external network time protocol (NTP) server. [41] While the Plaintiff contends that these Windows Event Logs are cryptographically secured and sequential, this Court finds that the baseline accuracy of the machine's internal clock configuration remains unverified by the Plaintiff. Under cross-examination, PW6 conceded that he did not independently analyse whether the laptop's BIOS settings or system dates had been manually backdated or tampered with prior to the logging events.

Conversely, the Defendant’s expert, DW2, provided clear, tabulated telemetry demonstrating documented instances of system date and time alterations on the device. Because digital environments can be artificially manipulated, the Plaintiff’s failure to forensically rule out initial clock configurations or BIOS-level vulnerabilities breaks the chain of certainty. ASSESSMENT AND REJECTION OF THE PLAINTIFF’S EXPERT EVIDENCE (PW6) [43] In analysing the technical evidence, this Court is guided by the established rule that expert witnesses are admitted solely to assist the Court with specialized knowledge. The ultimate decision-making authority rests exclusively with the trial judge. A court is legally duty-bound to reject an expert’s conclusions if they are found to be bare assertions or structurally compromised by bias. [44] Upon rigorous cross-examination, the credibility, objectivity, and independence of the Plaintiff's expert, PW6, were entirely dismantled. This Court bases this total rejection on three specific findings of fact: [a] Lack of Substantiation: PW6 concluded in his report that the Windows Event Log had not been tampered with. However, he admitted during cross-examination that this core finding was a bare assertion, completely unsupported by any technical metrics, diagnostic data, or validation entries within the body of his report. [b] Failure to Conduct Essential Verification: PW6 admitted he failed to inspect or verify whether the laptop's internal system clock had been modified. Furthermore, while the Plaintiff argued that Windows event logs are automatically secured, PW 6 admitted he was "not sure" if that feature was ever active or enabled on this specific laptop because he had neglected to check it. [c] Admitted Bias and Selective Reporting: PW 6 expressly admitted under cross-examination that he intentionally omitted technical findings or data from his final report that were disadvantageous or unfavourable to his client, the Plaintiff. [45] By sanitizing his forensic findings to protect his paying client, PW 6 violated the core ethical and legal duties of an expert witness, which demand absolute independence and transparency to the Court. An expert who selectively filters evidence to advance a party's narrative ceases to be a witness of truth and becomes an advocate. Consequently, this Court finds the testimony and report of PW6 to be deeply flawed, one-sided, and wholly unsafe to rely upon. EVALUATION AND ACCEPTANCE OF THE DEFENDANT’S EXPERT EVIDENCE (DW2) [46] This Court finds the Defendant’s digital forensic expert, DW2, to be a highly credible, objective, and scientifically logical witness. [47] The Plaintiff sought to dismiss DW2's evidence on the ground that his reports were primarily designed as a "rebuttal" rather than an independent baseline assessment, and criticized him for omitting a comprehensive analysis of 2,511 "LNK files" (shortcut files). [48] This Court rejects the Plaintiff’s criticisms as without merit. An expert appointed by the Defendant is entitled, and indeed expected, to provide rebuttal evidence to identify errors, omissions, and weaknesses in the opposing expert’s report. [49] As the burden of proof never shifts to the Defendant, DW2 was under no legal obligation to conduct a separate, exhaustive study of the LNK files. Unlike PW6, DW2 did not rely on bare assumptions; he provided clear, tabulated, and verifiable data demonstrating that the 17 system dates and times on the laptop had been altered prior to the forensic acquisition stage. His evidence properly guided the Court toward critical forensic anomalies that occurred while the laptop was in the Plaintiff’s custody. THE COMPROMISED CHAIN OF CUSTODY AND FORENSIC DESPOILMENT OF EVIDENCE [50] Digital evidence is fragile and can easily be altered, damaged, or corrupted if it is not properly handled. To preserve its reliability, there must be a clear and continuous chain of custody showing who handled the device, when it was handled, and what was done to it. [51] This Court finds that the Plaintiff failed to maintain a proper chain of custody over the laptop after it was surrendered on 2 April 2018. The Plaintiff did not produce any access logs, storage records, or digital audit trails to show who had possession of the laptop or what actions were taken on it. The timeline presented by the Plaintiff was not supported by contemporaneous records and appears to have been reconstructed later for the purpose of this litigation. [52] This Court takes judicial notice of the binding finding of fact made in a prior related proceeding between these identical parties (Industrial Court Award No. 606/2021), where it was judicially determined that the Plaintiff failed to establish a secure chain of custody over this exact laptop upon its return. [53] More importantly, based on the credible evidence of DW2, this Court finds that while the laptop was in the possession of the Plaintiff and its former technical advisors, several improper and destructive procedures were carried out on the laptop. These included: [a] Running data recovery software directly on the original drive, which could overwrite data and damage the original metadata; [b] Performing multiple disk defragmentation, which permanently changed the arrangement of data on the hard drive; [c] Inserting external devices into the laptop without proper control; and [d] Removing and later reinstalling the laptop’s internal hard disk drive. [54] These actions changed and damaged the original condition of the digital evidence. As a result of the Plaintiff’s own improper handling of the laptop, it is now impossible for any forensic expert to determine with certainty what data originally existed, when any changes were made, or who carried out the factory reset. The Plaintiff cannot damage the primary digital evidence through its own technical failures and then ask this Court to hold the Defendant responsible based on the remaining unreliable digital records. THE SERVER CONTRADICTION [55] The Plaintiff relied on what it described as a technical contradiction in the testimony of the Defendant (DW1), namely that the Defendant claimed the company files were preserved on the server while also admitting that the laptop was not physically connected to the office Local Area Network (LAN) server. [56] This Court accepts the Defendant’s explanation. Although the laptop was not directly connected to the office LAN file server, the laptop’s operational data, company emails, and financial information were synchronized through external internet-based mail and cloud servers. FAILURE TO ESTABLISH COMPENSABLE LOSS

The Plaintiff has further contended that, should liability be established, the issue of damages ought to be assessed separately before the Registrar pursuant to Order 37 Rule 1 of the Rules of Court 2012. In support of this proposition, reliance was placed on the decision of the Court of Appeal in Muhammad Yassein Zuliskandar v Kerajaan Malaysia [2019] 4 CLJ 289; [2018] 1 LNS 1306. [58] Having considered the said authority and the evidence before this Court, this Court is of the view that the Plaintiff's reliance thereon is misplaced. The principle embodied in Muhammad Yassein Zuliskandar is applicable where liability has been established and the existence of actual loss or damage has already been proven, leaving only the quantification of such damages to be determined at a subsequent assessment. The purpose of an assessment before the Registrar is to ascertain the amount of damages recoverable and not to determine whether compensable loss exists in the first place. [59] It is trite law that a distinction must be drawn between proof of damage and proof of the quantum of damage. Before an order for assessment can be made, a plaintiff must first establish, on a balance of probabilities, that it has suffered actual loss or damage as a consequence of the defendant's wrongful conduct. Only after the existence of such loss has been proven does the issue of quantification arise for determination. [60] In the present case, while the Plaintiff alleges that substantial company data was permanently deleted from the laptop, the evidence adduced falls far short of establishing that any actual loss was suffered. Significantly, the evidence revealed that the Plaintiff's former technical advisor, PW5, had successfully recovered approximately 75GB of data from the laptop's solid-state drive (SSD). Notwithstanding the apparent significance of this recovered data, the Plaintiff failed to disclose its 20 contents to the Court. More importantly, PW6 candidly admitted that he had been instructed not to analyse the recovered 75GB of data. [61] The consequence of this omission is substantial. The Court is left without any evidence as to whether the allegedly deleted corporate information had in fact been recovered, whether the recovered data contained the very financial records and business documents which the Plaintiff claims were lost, whether any critical information remained unrecovered, or whether any actual loss continued to subsist following the recovery process. In the absence of such evidence, the Court is unable to determine whether the Plaintiff suffered any real prejudice arising from the alleged deletion of data. [62] This Court finds that the Plaintiff was in possession of the best available evidence concerning the contents of the recovered 75GB of data. Yet, despite having every opportunity to do so, the Plaintiff elected not to produce that evidence and further instructed its own expert not to analyse it. No satisfactory explanation has been provided for this omission. [63] In these circumstances, section 114(g) of the Evidence Act 1950 becomes operative. Under that provision, the Court may presume that evidence which could be and is not produced would, if produced, be unfavourable to the party withholding it. Having regard to the Plaintiff's deliberate failure to disclose or analyse the recovered data, this Court draws an adverse inference against the Plaintiff. The Court is entitled to presume, and accordingly presumes, that the recovered 75GB of data contained the very financial records, corporate documents, and business information which the Plaintiff alleges were permanently destroyed.

Once that adverse inference is drawn, the foundation of the Plaintiff's claim becomes significantly undermined. If the allegedly deleted data had in fact been recovered, the Plaintiff cannot simply assert that loss was suffered without identifying what information remained unavailable or demonstrating how any unrecovered data translated into measurable damage. The Plaintiff has not identified with specificity the documents allegedly lost, the significance of such documents to its business operations, whether copies existed elsewhere within its systems, or the financial consequences arising from their alleged loss. [65] Apart from broad assertions that company information was deleted, no evidence has been adduced to establish loss of revenue, loss of business opportunity, loss of contractual rights, additional operational costs, or any other measurable detriment suffered by the Plaintiff. The Court therefore finds that the Plaintiff has failed to establish not merely the quantum of its alleged loss, but the existence of compensable loss itself. [66] To order an assessment of damages in such circumstances would effectively permit the assessment process to be used as a means of determining whether damage exists in the first place. That is not the purpose of an assessment under Order 37 Rule 1. The assessment procedure is intended to quantify proven loss and not to enable a Plaintiff to search for evidence of loss after succeeding on liability. [67] Accordingly, this Court finds that the Plaintiff cannot rely on Muhammad Yassein Zuliskandar to overcome its failure to prove actual loss or damage at trial. In light of the recovery of 75GB of data, the Plaintiff's failure to disclose or analyse that data, and the adverse inference properly drawn pursuant to section 114(g) of the Evidence Act 1950, this Court is unable to conclude that the Plaintiff has established the existence of compensable damage on a balance of probabilities.

Having failed to show that any data was permanently lost to its business network or that any actual loss resulted therefrom, the Plaintiff's claims founded on breach of contract, breach of fiduciary duty, negligence, and breach of confidentiality are left without the necessary evidential foundation. Consequently, there is no basis upon which an order for assessment of damages may be granted. THE PROCEDURAL DEFENSES: RES JUDICATA AND LACHES [69] Issue Estoppel / Res Judicata: The Plaintiff contends that the prior Industrial Court action was strictly an administrative employment dispute distinct from this common-law suit. This Court disagrees. The underlying factual matrix, the key digital asset, and the specific allegations concerning the unauthorized deletion of data were already extensively litigated, analysed, and ruled upon by a competent tribunal in Industrial Court Award No. 606/2021. To permit the Plaintiff to re-package the identical factual dispute into a fresh civil action in the High Court constitutes a grave abuse of the judicial process and is strictly barred by the doctrine of issue estoppel. [70] Laches and Delay: The subject laptop was returned to the Plaintiff in 2018, yet this High Court action was not initiated until 2021. Equity aids the vigilant, not those who slumber on their rights. By delaying legal proceedings and forensic acquisition for years—during which time its own staff subjected the machine to destructive, unlogged technical interventions—the Plaintiff has deeply prejudiced the Defendant's ability to mount a fair technical defence. The claim is therefore barred in equity by the doctrine of laches. CONCLUSION

The Plaintiff has failed to discharge the continuous legal burden of proving, on a balance of probabilities, that the Defendant carried out the factory reset on 27 March 2018. [72] It was also the finding of the Industrial Court, where the Chairman stated that the Plaintiff had failed to produce any document or evidence that LSA, without the approval of the Plaintiff, deleted all the company data or records. The Industrial Court also fins that the Plaintiff has failed to discharge their burden of proof in respect of this charge. The Chairman further found that the termination of the Defendant’s employment was unjust and that the serious misconduct alleged by the Plaintiff, including the aforesaid allegation, had not been proven against the Defendant. [73] Therefore, on the balance of probabilities, the Plaintiff’s claim against the Defendant is hereby dismissed with cost of RM50,000.00. Dated 1 June 2026 8SGD (Rozana binti Ali Yusoff) Judge High Court of Penang Counsels for the Plaintiff : Szu Fu Chan & Nur Aisyah Hamir Messrs Chan, De Vries & Co. Counsels for the Defendant : Shamshul Bin Jamil & Terry Lim Messrs Presgrave & Matthews