A resignation to a direct rival, a laptop handed back, and one narrow question: had company data gone with them? The answer mattered less than whether it would stand up — which is decided in the first hour, before anyone looks at anything.
A salesperson left a Manchester company for a direct competitor. The firm suspected the client database and current price lists had been copied before the laptop came back. They could not prove it, and they needed to, to a standard their solicitors could rely on.
The question was narrow and specific: had data left the business, and by what route. Everything that follows was aimed at answering that in a form that survives being challenged.
The technical findings in a matter like this are usually not in dispute. What gets disputed is whether the evidence means what it is said to mean — and that is a question about handling, not about analysis.
So the laptop was never examined directly. It was imaged first, through a hardware write blocker, into a forensic container format that carries verification inside the file rather than alongside it: a hash computed over the acquired data and stored in the image, plus checksums on each block as it is written. Re-verify the image at any later date and it either matches the value recorded at acquisition or it does not. There is no room for an assurance that nothing changed.
The physical machine was then sealed, labelled and stored, with the seal recorded. Every subsequent step ran against a read-only mount of the duplicate, under an analysis tool keeping its own audit log — so the sequence of operations is itself reproducible.
None of this is ceremony. If the matter reaches a tribunal, the first question asked of a technical report is what was done to the original, and “we looked at it” is a poor answer.
The useful part, because most people assume deleting the files ends the story. Windows keeps several independent records of activity, none of which the user is thinking about.
The file system’s own journals. NTFS maintains a change journal recording creations, deletions, renames and modifications with timestamps, and a separate transaction log used for crash consistency. Between them they preserve a record of file activity long after the files are gone.
Registry evidence of every USB device ever attached. Windows records removable storage in the registry as it is installed, keyed by vendor, product and — where the device provides one — its serial number. Alongside that, the device installation log carries first-connection timestamps. A specific stick can therefore be distinguished from an identical stick bought the same day.
Shortcut and jump-list artefacts. Opening a file from removable media leaves a shortcut recording the volume serial number and the path it came from. Those persist after the device is gone and after the file is deleted.
Browser and mail stores. Cached history and the local mail database hold their own timeline, independent of anything on the server.
The point is redundancy. Any single artefact can be explained away. Four independent records agreeing on the same evening are considerably harder to dismiss.
The file-activity record was unambiguous. On one evening, forty-eight hours before the resignation, the client database and a batch of price-list spreadsheets were written out in quick succession.
Lining that window against the USB history identified what received them: a removable device logged by serial number, connected minutes after the exports began and disconnected shortly after they finished.
The mail store, once indexed, held two messages to a private address with a price list attached. Browser history from the same minutes captured a webmail session and a file upload to personal cloud storage — a second channel, and one that would have been missed entirely had the enquiry stopped at the USB stick.
Several of the exported files had been deleted afterwards. Those were recovered by carving them from the image, and their content compared against the versions held on the company’s own systems.
The deliverable was a single hash-verified report drawing every thread together: the exported files and when each was written, the removable device and its connection timestamps, the two emails, the cloud upload, and the recovered deletions — each anchored to the audit trail and each traceable back to the verified image.
It went to the firm’s legal team to act on as they saw fit. Five working days from arrival to report.
Worth stating, because it is the first thing we establish and occasionally the reason we decline.
Workplace investigations are undertaken only for the owner of the equipment and only on written instruction. A company-owned laptop returned by a departing employee is the owner’s property to examine. A personal device is not, whatever is on it and whoever asks.
Where an examination is likely to encounter the individual’s personal correspondence — and on a laptop that has been in daily use it usually will — the scope is agreed in advance and the examination confined to what the instruction requires. Forensic examination and reporting is from £800 +VAT.
Send the device over with a short account of what happened to it. The diagnostic costs nothing and commits you to nothing, and the figure that follows is fixed in writing before anything is opened.
Nothing can begin until the device is on the bench, which makes this the only step that needs anything from you. Pack it properly, put your details in with it, and send it over. What follows is a free diagnostic and a written figure, in that order.
Posting it? Use something tracked and insured — whatever is on the drive is worth considerably more than the postage. Bringing it in? Weekdays, 9am to 5:30pm, and it still wants packing as above for the journey.
Tell us what the device is, what it is doing, and anything already tried — an engineer will come back with a realistic view of the odds and a price band, before you commit to posting anything.
We’ll be in touch shortly. For anything urgent, call 0161 871 0788.
Forensic recovery establishes what happened on a device and preserves the evidence so it stands up later. Media is imaged behind a write blocker, hashed to prove the copy is identical, and every step logged so the chain of custody holds — typically following ACPO principles for digital evidence.
Often, yes. USB connection records, link files, jump lists, registry artefacts and file system timestamps together show what was attached and what was opened or copied, and when. What can be proven varies by system and by how much has happened since.
Forensic investigation starts from £800 plus VAT, quoted after a scoping discussion. Forensic work is not offered on a no-fix-no-fee basis and carries a 50% deposit, because the analysis has value whatever it concludes.
Start with an instant online quote, or call and talk it through with us first. You'll have a clear, fixed price before any work begins.