Data that leaves by email or cloud creates two records, one on the machine and one in the service, and a proper investigation reads both. We take mailbox rules, attachment history and sign-in patterns from the tenant, plus browser and sync artefacts from the device, and correlate them into a single dated account of what went where, for York employers and their advisers.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
Behavioural clues that are individually explainable yet collectively form a pattern: these are the observations that start cases.
When a mailbox is being used to move data outward there will be recognisable behaviours. The size of attachments increases and the recipients narrow to only 1 personal address; a forwarding rule is created, quietly copying selected emails outward; search history shows hunting (customer names, project terms, price lists etc.) rather than day-to-day work; access times change to evenings and weekends. All of these are recorded by the email platform itself, then retrieved and dated during the examination.
The other half comes from the device. Browser artefacts record sign-ups/sign-ins to the employee's private Dropbox, OneDrive & Google Drive accounts from the corporate machine; sync-client logs & folder structures show which directories were being mirrored upwards and when; residue of uploads (cached pages, transfer confirmations, recent-file lists etc.) remains on the image long after the browsing history has been cleared. A private cloud account appearing on corporate hardware in the final month is most likely not idle.
Both Microsoft 365 and Google Workspace have their own forms of evidence, which is frequently decisive. The messages that were moved, shared and downloaded by users are recorded in the Purview audit logs and eDiscovery exports. Mail and files under hold are preserved by Google Vault. Every time an item was shared or bulk-downloaded through SharePoint and OneDrive, a log entry was made listing the user account and the date/time. Version histories and recoverable deleted files are kept by Dropbox. Deleted mailboxes can often be recovered from retention or backup systems, but only for a limited window, and that window is the reason you should contact us early.
It is the correlation of findings that provides the best evidence, e.g. the tenant has logged a 2.1GB download at 21:14; the device has logged the same files entering a personal sync folder at 21:16; the browser history has closed the loop. All device and service evidence is assembled into one timeline; disagreements between the two are flagged; everything (mailbox exports, audit extracts, machine image) is preserved under hash before any account is suspended or licence reclaimed.
There is a broader approach described on the forensic recovery hub. Evidence related to credentials and servers continues on insider threat forensics; employer casework is discussed on employee data theft; legal hold practices and chain of custody are covered on legal hold & chain of custody. Pricing information can be found on our prices page.
A single timeline showing both service records and machine artefacts, cross-checked.
When did they go out to personal addresses? What size did those items move?
Rules for forwarding and deleting emails, with creation date and scope.
Time and location of sign-ons (and the out-of-hours groups that have unusual login activity).
Sign-ups, synchronisation folders and upload residue on the company computer.
Sharing, download and export events from both M365 & Workspace log files.
Messages deleted and mailboxes recovered via retention and backup.
The free diagnostic provided at the beginning of each case will be completed within two working days of arrival; all forensic casework is paid in advance as soon as you accept the fixed quote. A full forensic investigation including a report costs £800 + VAT, payable 100% in advance. The less expensive option is the forensic binary image and deleted-file extraction service without the report, at £400 + VAT. All forensic services will need to be pre-paid. Quotes for multi-account or tenant-wide scopes will be prepared in writing after the free assessment. Both prices are listed on our prices page, and the written scope is agreed before any payment is taken.
Email and cloud casework is processed either from the company tenancy/device or at the instruction of a solicitor. The instructions can be taken in only three ways: equipment that the company itself owns; an instruction from a solicitor, insurer or court; or devices which are genuinely the client's own (including jointly owned machines in matrimonial cases). We do not hack, intercept live communications nor examine a device that the client has no right to examine.
Cloud evidence can be preserved by export as well as by post. For your quote please call us on 0800 689 0668, and you will be able to discuss what can be captured remotely and what needs to travel. Drives (not whole machines) are received at our Leeds laboratory, where they are signed into custody on receipt.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Retention windows do run out, so contact us via our free telephone number before they expire.