HR investigation · disciplinary · proportionate · scoped · ICO monitoring guidance · company device
HR investigations and disciplinary evidence. A disciplinary stands or falls on evidence gathered properly, scoped to the allegation and no wider.
An HR investigation needs evidence that is sound and gathered properly, because a disciplinary decision built on an overreaching or improperly obtained examination is a decision that can be challenged. We examine company-owned devices for employers, scoped to the specific allegation and the relevant period, and no wider. The ICO's guidance on monitoring workers expects any examination to be necessary, proportionate and respectful of employees' rights, and to avoid being routinely covert; we work within that, filtering out personal material that falls outside the scope rather than trawling the whole device. What the standard report contains is driven entirely by the allegation: web and download history where misuse of the internet is alleged, installed software where unauthorised programs are the issue, file access and a timeline where the question is what was done and when. It is a factual account for the HR process, and its author can give evidence of fact if needed.
Rather talk it through? An engineer answers the bench line
0800 6890668
Who instructs us, and the authority we need.
The instructing party is the employer, the device is company property, and the examination is on a lawful basis tied to a specific allegation. We ask for the company's confirmation of ownership, the lawful basis, the monitoring and acceptable-use policy staff were given, and a clear scope: what is alleged, and over what period.
Proportionality is the governing idea. The ICO's guidance on monitoring workers expects an examination to be necessary and proportionate, so we examine the artefacts relevant to the allegation and the period, and we do not reproduce personal material, a private email account, family photographs, personal banking, that falls outside the scope. Where a data protection impact assessment is expected, that is the employer's to prepare; we can describe what the examination will and will not involve to support it.
Covert examination is the exception, not the rule, and the ICO is clear that monitoring should not routinely be done in secret. We work to a defined, proportionate scope, and we are candid where an allegation does not justify the breadth of examination requested.
What the standard report typically contains.
The questions it can answer, and what it cannot.
Describe your situation →| What you want to know | What the examination shows | What it cannot prove on its own |
|---|---|---|
| What the device shows was done in the period | File access, web history, software, a timeline | Intent, or who was at the keyboard |
| Whether unauthorised software was installed | Installation and execution records | Why it was installed |
| Whether the internet was misused as alleged | Browser history and downloads, with times | The purpose behind each visit |
| That the examination was proportionate | A scope tied to the allegation and the period | Anything about matters outside the agreed scope |
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send the exhibit
- Define the allegation and the period before instructing; a tight scope is both fairer and more defensible.
- Suspend the account rather than the device where you can, then preserve the device, so the evidence is not disturbed.
- Have your monitoring policy to hand; whether staff were told their devices may be examined matters to the lawfulness of the process.
The ICO's 2023 guidance on monitoring workers expects any examination to be necessary, proportionate and not routinely covert; a scoped report is the proportionate approach.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the questions you need answered
What sets us back
- Letting IT or anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Assuming artefacts prove who was at the keyboard
Questions answered before you instruct.
Can we use the report in a disciplinary hearing?
Yes. The standard report is a factual, proportionate examination scoped to the allegation, suitable for an HR process, and its author can give evidence of fact about what was done and found. Keeping the scope tied to the allegation is what makes it both fair and defensible.
Is it lawful to examine an employee's work computer for a disciplinary?
Where the computer is company property, the examination is on a lawful basis, and it is proportionate to the allegation, yes. The ICO's guidance expects monitoring to be necessary and proportionate and not routinely covert. We scope the work to the allegation and filter out unrelated personal material.
Can you just examine the whole computer to see what you find?
That is rarely proportionate, and we will not do it as a matter of course. We examine the artefacts relevant to the allegation and the period. A fishing exercise across an employee's whole device is both harder to justify and easier to challenge.
What about the employee's personal data on the device?
We filter it out. Where the examiner must briefly classify an item to decide whether it falls within the scope, that is done minimally and the item is not reproduced. The report concerns the allegation, not the employee's private life.
What does it cost?
The standard report for the one device is £800 + VAT. The first conversation is free, and we will tell you honestly whether the allegation justifies an examination at all.
The device holds the answer; preserve it first.
The first conversation is free, and it starts with who owns the device and what you need to know. Tell us the situation and we will tell you whether we can take it on, what authority we need, and whether the standard report or an expert report fits. Until then, stop using the device and preserve it as it is.