Illustrative — synthetic data · Shareholder dispute · board resolution · mass deletion · wiping tool · mail rules
Sample report: an office PC in a shareholder dispute. A mass deletion, a cleaning tool and two mail rules, placed in time.
After a director of Oakfield Design Ltd left in a dispute, company records were found to be missing from the office PC. The two remaining directors, by board resolution, instructed an examination. This illustrative report shows how the standard report places a deletion against the key date, and what it leaves to others.
Rather talk it through? An engineer answers the bench line
0800 6890668
1. Scope and the questions asked.
The questions were: (a) whether company records on the PC were deleted or wiped, and when, relative to 17 April 2026; (b) which user account was in use; (c) whether forwarding or auto-delete rules were set in the local mail profile; (d) whether a wiping or cleaning tool was installed or run.
2. Authority and lawful basis.
The PC is company property, and the board resolved to authorise its examination; the company's solicitor confirmed the dispute and the date of the demand letter. A personal email account configured in the mail client was identified but not accessed, and was not signed into.
3. Exhibit and integrity.
| Item | As recorded |
|---|---|
| Condition on receipt | Powered off; sealed by the company; intact |
| Drives | 1 TB SATA SSD (system); 2 TB SATA hard disk (data) |
| Write blocker | Hardware write blocker for both drives |
| Images | Two E01 images; logs at Appendix A |
| Hashes (placeholders) | Source and image matched for both drives |
| Re-verified | Before analysis and before issue; unchanged |
| Fee note | A two-disk system, quoted as extra |
4. Tools and method.
OSForensics for the $UsnJrnl, Prefetch and event log viewers, installed-programs review, Deleted Files Search, the email viewer and the case report; Autopsy to confirm the USN journal event counts. Times are UTC.
5.1 Accounts and logons.
Three local accounts exist. The former director's account logged on interactively on 18 April 2026 at 07:52 UTC and logged off at 09:41 UTC (Security log events 4624 and 4647). No other interactive logon is recorded that day.
5.2 Mass deletion.
The USN journal on the data disk records 6,318 delete operations under that account between 08:04 and 09:17 UTC on 18 April 2026, the day after the demand letter, in three company folders. In the 90 days of journal available before 18 April there is ordinary daily activity and no comparable deletion.
Table 5.2: Mass deletion
| Folder | Files deleted | Recovered intact | Partly | Not recovered |
|---|---|---|---|---|
| D:\Oakfield\Projects | 3,102 | 1,688 | 1,014 | 400 |
| D:\Oakfield\Accounts | 1,904 | 131 | 702 | 1,071 |
| D:\Oakfield\Contracts | 1,312 | 125 | 494 | 693 |
5.3 Cleaning tool.
Prefetch records a cleaning tool first run at 08:01 and last run at 09:20 UTC on 18 April, with a run count of four; its installer was downloaded at 07:58 according to browser history, and the Application log records its installation at 08:00. The tool's settings file shows its secure-deletion option enabled with a three-pass overwrite. The unrecovered files fall largely in the Accounts and Contracts folders, which is consistent with overwriting.
5.4 Mail rules.
The local mail profile for the company account holds two rules created on 16 April 2026: one forwarding all incoming mail to an external address, domain redacted here; one moving mail from the two remaining directors to Deleted Items. Rule creation times are taken from the mailbox data file.
6. Timeline extract.
| Time (UTC) | Event | Source |
|---|---|---|
| 16 Apr | Two mail rules created | Mailbox data file |
| 17 Apr | Demand letter dated (given) | Instructing solicitor |
| 18 Apr 07:52 | Former director's account logs on | Security log |
| 18 Apr 07:58–08:01 | Cleaning tool downloaded, installed, first run | Browser history, Application log, Prefetch |
| 18 Apr 08:04–09:17 | 6,318 files deleted in three folders | USN journal |
| 18 Apr 09:20 | Cleaning tool last run | Prefetch |
| 18 Apr 09:41 | Logoff | Security log |
7. Limitations.
The account used is recorded; who was at the keyboard is not. Overwritten files cannot be recovered by anyone. The forwarding rule's existence and creation time are recorded; what was forwarded afterwards is held in the recipient's systems, not on this PC. The examination does not consider why the deletions were made.
8. Conclusions, as fact.
On 18 April 2026, the day after the demand letter, under the former director's account, a cleaning tool was downloaded, installed and run with overwriting enabled, and 6,318 company files were deleted, 1,944 of which were recovered intact; two mail rules forwarding and diverting company mail had been created two days earlier.
9. Exhibits and appendices.
Exhibits: E1 PC, returned resealed; E1/IMG1 and IMG2 images, retained encrypted; recovered files on encrypted media. Appendices: A acquisition logs; B tool versions; C recovered files with hashes; D USN journal extract; E glossary.
The service this report illustrates.
This is what the standard report looks like.
The standard forensic report for a one-disk system is £800 + VAT. Tell us the situation and who owns the device, and the first conversation will tell you whether it answers your questions.