Quite often, corporate misconduct is revealed by disgruntled employees or ex-employees.
When no inside source is available, and the only proof you have is the compiled binary of the product, it might get harder to prove that a copyright violation has happened. But there are a few things you can try:
- One possible sign is identical behavior. When both products have the exact same obscure bug, it might be a sign that they obviously use the same code-base. When a product is based on an open source product, they likely did so because they did not want to reimplement everything themselves, so you can assume that most of the behavior will be the same.
- When there is a limited amount of possible compiler toolchains and settings for the technology used to build the application, you might be able to reproduce the build-process and generate a binary from the open source codebase which is in large parts identical to the binary delivered by the company. This would be clear evidence that a copyright violation has happened.
- Sometimes you find debugging symbols or other identifiers in a binary which hint on the structure and content of the original sourcecode. This can be a smoking gun. However, these can be suppressed through technology-dependent compiler-settings and/or obfuscators.
Whether or not any of this evidence would hold up in court is a question only a lawyer can answer.