Code Comparison
Two codebases. One party says the other was built from their work. The question is whether that's true, and if it is, how much and when.
Code comparison is the analysis step after collection. We compare two collected repositories line by line and report what they share, how the shared material got there, and what the history shows about when it arrived.
We report what the code shows. What it means for the claim is for the court.
What do you need from me?
Both codebases
Collected by Traces, or produced under an order and handed to us in a verifiable state. A comparison is only as good as the weaker of the two sides.
What's alleged
Which components, which period, what the claim actually says was taken. A comparison scoped to the pleaded case is far more useful than one run across everything.
Anything you already know about shared origins
Common contractors, a shared framework, code that started life open source. This isn't us being told the answer — it's the difference between a finding that survives cross-examination and one that doesn't.
What do we do?
Exact matches
Identical sequences of code appearing in both. The starting point, and the least interesting on its own.
Near matches
The same logic with names changed, formatting altered, or sections reordered. Renaming a variable doesn't change what the code does, and it doesn't hide the similarity from a proper comparison.
Structural similarity
How the code is organised — the shape of the architecture, how components relate. Two teams solving the same problem produce similar structures; a copied codebase produces the same one.
Provenance from history
This is where a repository comparison beats comparing two folders of files. The history shows when a line first appeared, in which codebase, and who committed it. When something exists in one repository months before it appears in the other, that sequence is a matter of record rather than an inference.
What we can't do
Whether copying happened
It tells you code is shared. Shared code has innocent explanations — a common dependency, a public tutorial, an open source library, the same developer writing the same way twice. We identify and account for those where we can, and we say plainly where we can't.
Who did it
Commit metadata records the account that made the commit, not the person at the keyboard. It's strong evidence and it isn't proof of identity.
Why two things look alike
Some problems have one obvious solution, and two competent developers will write nearly the same thing. A comparison that ignored that would produce a number that falls apart under questioning.
A percentage that means anything on its own
"Thirty per cent shared" is a figure without a claim attached. Thirty per cent of what, excluding which libraries, measured how? We publish the method alongside any figure so it can be checked — and we won't give you a number we can't defend.
What do I get back?
A comparison report
Written for a court, not for engineers. What was compared, how, what was found, and what it means technically. Findings are set out with the code alongside so anyone can check the working — including the other side's expert.
The evidence behind every finding
For each overlap: where it sits in both codebases, how much there is, and what the history says about when each version appeared.
A method statement
What tooling was used, what was excluded and why — third-party libraries, generated code, standard boilerplate — and what the limits of the analysis are.
Chain of custody
Linking back to the collection of both codebases, so the line from repository to exhibit is unbroken.
Where you need it, the report can be prepared as a CPR Part 35 compliant expert report, with the declarations the relevant rules require. Say so at the scoping call rather than afterwards — it changes how the work is documented from the start.
One more thing
If we compare two codebases and find nothing meaningful, that is the finding, and you get the same report saying so. We appreciate this is a blunt statement; our duty is always to report the evidence as it is found, and we do not bias the instructor in any analysis.
Our own records of the engagement - who instructed us, what we were asked to do, what we did - is retained for six years. Traces will hold a copy of the ZIP for 90 days once we have confirmed you have downloaded and can access the bundle. You can at any time request the deletion of your collection from Traces.