Employment · disputes · insurance · family · probate · defence
Forensic services, by situation. The situation and the authority decide what can be done. The technology is the same underneath.
What a forensic examination can do for you depends far less on the technology than on the situation and on who has authority over the device, so we organise our work by situation. The business situations, a departing employee suspected of taking data, a falling-out between partners or shareholders, an HR matter, a theft of designs or client lists, run on company-owned devices and the employer's lawful basis. The personal and legal situations, a divorce, harassment you have received, a deceased relative's computer, an insurance claim, a criminal defence review, each have their own authority and their own limits. One rule runs through all of them: we examine a device only for the person or organisation entitled to, we ask for proof of that before we start, and we will not touch a device or account belonging to someone who has not consented. Find your situation below. Each page says who can instruct us, the authority we need, what the standard report will contain, the questions it can answer, what it honestly cannot prove, and when a court expert report is needed instead.
Rather talk it through? An engineer answers the bench line
0800 6890668
The three things every situation has in common.
Find your situation.
Describe it to us → →Business and employment
Departing employee data theftA company laptop, a director's authority, and the artefacts of removable storage, cloud uploads and last-minute deletions→Business partner and shareholder disputesA company device, a board's or court's authority, and deletion or wiping timed against the dispute→HR investigations and disciplinary evidenceScoped to the allegation, proportionate, and usable in the process without overreaching→Intellectual property theftDesigns, source and client data copied or sent; preserved on day one before anyone looks→Insurance claims: damaged devices and data lossThe condition documented, the data recovered, and what existed and when, for the claim→Personal, legal and insurance
Divorce and family finance, by lawful disclosureYour own device, or a solicitor's instruction under a court order; never a spouse's private device→Harassment and threats received on your own deviceThe messages you received, preserved with their headers and dates, for the police or a court→Probate: a deceased person's computerAn executor's grant, and a catalogue of the accounts and records the estate needs→Deleted CCTV and DVR footageThe recorder's own drive, the footage that survives before it is overwritten, and the clock→Criminal defence review of digital evidenceSolicitor-instructed; the prosecution's integrity record and artefacts independently checked→The one thing to do before you contact anyone.
Whatever the situation, the single most useful thing you can do is preserve the device and stop using it. A computer in daily use overwrites the very evidence an examination depends on: the timeline fills up, recently-opened lists roll over, and the free space that holds deleted files is reused. Reinstalling Windows, running recovery software, or letting IT open the machine to have a look all change it. Power it off, set it aside, and record who has held it since.
If the matter might end up in a dispute or in court, the duty to preserve evidence has already begun, and a device that has been wiped or reimaged can harm the very case it was meant to support. For a departing employee or an urgent IP matter, the priority is a preservation image taken straight away, before anyone examines the device, so the evidence is secured while decisions are made.
Then tell us the situation and who owns the device. We will tell you honestly whether we can take it on, what authority we need, and whether the standard report or an expert report fits, and that first conversation costs nothing.
The questions that come up first.
How do I know whether I am allowed to have a device examined?
If you own it, you are. If it is a company device, the company can authorise its examination on a lawful basis. If it belongs to someone else, you need their consent or a court order. If you are not sure, tell us the situation and we will tell you what authority is needed, or that it cannot be done.
Do you investigate a partner's or ex-partner's phone or computer?
No. We do not examine another adult's device or accounts without their consent or a court order, and we do not install monitoring software or undertake covert surveillance. In family matters we act only for a device's owner on their own device, or on a solicitor's instruction under a court order or agreed disclosure protocol.
What does an examination cost?
The standard forensic report for a one-disk system is £800 + VAT, a factual examination you can act on. A second disk is quoted as extra. A court expert report, written to the expert-evidence rules with declarations and attendance, is quoted separately and runs into the thousands. The first conversation is free.
Do you examine mobile phones?
No. We examine computers, drives and recorders. Mobile phones are not examined on this service.
Find your situation, and preserve the device.
Each service page says who can instruct us, the authority we need, and what the report will show. Tell us the situation and who owns the device, and the first conversation will tell you honestly what can be done.