The Digital Heist: 63 Files in Three Hours
What happened next, according to Apple’s forensic analysis, was a sophisticated data exfiltration operation. On June 23, 2025—just three days before his departure—Shi allegedly downloaded 63 files from Apple’s secure Box storage system between 9:51 PM and 12:37 AM. The files included:
- Confidential schematics for temperature sensors and ECG functionality
- Internal specifications for PPG (photoplethysmography) sensors that measure heart rate and blood oxygen
- Apple’s Silicon Engineering Group documents on proprietary chip technologies
- Product roadmaps for unreleased Apple Watch features
Shi then allegedly organized these stolen files into a folder labeled “苹果相关” (“Apple Related”) and transferred them to a USB drive at 1:09 AM on June 25—one day before his departure.
The Cover-Up Attempt
Perhaps most tellingly, Apple’s investigation revealed Shi’s consciousness of guilt. On June 16, he searched Google for “how to wipe out macbook.” On June 23—the same night he allegedly downloaded the files—he searched “Can somebody see if I’ve opened a file on a shared drive?”
These searches suggest Shi knew exactly what he was doing and was actively trying to cover his tracks, according to legal experts familiar with trade secret cases.
