Data that leaves by email or cloud makes two records — one on the machine, one in the service — and a sound investigation reads both. Mailbox rules, attachment history and sign-in patterns from the tenant; browser and sync artefacts from the device; correlated into a single dated account of what went where, for York employers and their advisers.
◇ Method before speed. The free assessment and a written scope come first; forensic fees are settled in full before any examination starts. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.
Individually explainable, collectively a pattern — these are the observations that start cases.
A mailbox being used to move data out behaves in recognisable ways. Attachment sizes climb, and the recipients narrow to one personal address; a forwarding rule appears, quietly copying selected mail outward; the mailbox search history shows hunting — customer names, project terms, price lists — rather than day-to-day work; and access times drift to evenings and weekends. Each of these is recorded by the mail platform itself, and each is retrieved and dated in the examination.
The device tells the other half. Browser artefacts record sign-ups and sign-ins to personal Dropbox, OneDrive and Google Drive accounts from the company machine; sync-client logs and folder structures show which directories were being mirrored upward and when; and the residue of uploads — cached pages, transfer confirmations, recent-file lists — survives on the image long after the browsing history is cleared. A personal cloud account appearing on company hardware in a final month is rarely idle.
Microsoft 365 and Google Workspace keep their own evidence, and it is frequently decisive. Purview audit logs and eDiscovery exports record message movements, sharing events and downloads; Google Vault preserves mail and files under hold; SharePoint and OneDrive logs list every share and bulk download with account and timestamp; Dropbox holds version histories and recoverable deleted files. Deleted mailboxes can often be restored from retention or backup — for a limited window. That window is the reason to call early.
The finding that persuades is the correlated one: the tenant logs a 2.1 GB download at 21:14, the device shows the same files entering a personal sync folder at 21:16, and the browser history closes the loop. We assemble device and service evidence into one sequence, flag where the two disagree, and preserve everything — mailbox exports, audit extracts, the machine's image — under hash before any account is suspended or licence reclaimed.
The wider method is at the forensic recovery hub. Server-side and credential evidence continues on insider threat forensics, the employer casework on employee data theft, and preservation practice on legal hold & chain of custody. Fees are on our prices page.
Service records and machine artefacts, cross-checked and presented as one timeline.
What went to personal addresses, when, and at what size.
Forwarding and deletion rules, with creation dates and scope.
Sign-in times, locations and the out-of-hours clusters that stand out.
Sign-ups, sync folders and upload residue on the company machine.
Sharing, download and export events from M365 and Workspace logs.
Deleted messages and mailboxes restored from retention and backup.
The free diagnostic that opens every case is completed within 2 working days of arrival; forensic casework itself is not a no fix, no fee service. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. Multi-account and tenant-wide scopes are quoted in writing after the free assessment. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
Email and cloud casework proceeds on company tenancies and company devices, or under a solicitor's instruction. Instructions are accepted on three footings only: equipment the company itself owns; the instruction of a solicitor, insurer or court; or devices that are genuinely the client's own — including jointly owned machines in matrimonial matters. We do not hack, we do not intercept live communications, and we do not examine a device the instructing client has no right to examine.
Cloud evidence is preserved by export as much as by post. Call 0800 689 0668 to walk through what gets captured remotely and what travels; devices are received at our Leeds location with custody recorded from signature.
Is the drive still inside a computer, laptop, MacBook, iMac, CCTV / DVR or server? Take the hard drive or SSD out first and post the bare drive on its own — removing drives from machines isn't a service we offer. Storage that's soldered to a motherboard (Apple Silicon Macs, certain slim laptops) is the one thing we can't work on: if it doesn't come out, it can't come in.
↓ Print the booking-in & shipping form (PDF)
Address the parcel for the attention of Leeds Data Recovery — about 40 minutes from York via the A64 and A1(M), or next working day by tracked post. You'll hear from us the moment it's booked onto the bench.
Not certain what to pack? Ring 0800 689 0668 first, or run the free online diagnostic.
Retention windows close on their own schedule — ring the freephone before they do.