When an employee leaves a Clifton Moor distribution centre or a Monks Cross head office, the laptop comes back, and within a month a familiar customer list is being worked by somebody else. The machine can usually settle what happened, provided it is secured before anyone logs into it. We examine it systematically and report what the evidence supports, no more and no less.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
Any one of these on its own is reason to take the device out of use, untouched, until it has been imaged, regardless of where the company is based (York, Malton or anywhere along the A64).
The strongest employee theft cases are decided in the first hour, by holding back. Each time someone logs on, new data is written over old; each time IT has a helpful look through the relevant folders, the dates on the files that matter change; and handing the laptop to the next starter can end the question for good. So our process is very simple. Turn off the laptop. Label it. Record who has had possession of it. Let it sit idle until it has been imaged. The examination then runs on the verified image, and the laptop itself stays sealed: available, unchanged and ready for the other side's forensic examiner to check.
Windows keeps much better records than most witnesses. The USBSTOR registry key documents every removable device the machine has seen, by maker, model and serial number, and setupapi.dev.log records when each one was first connected. Link files and jump lists show which company files were opened from the drive letter of a removable volume, and shellbags show the directory layout that was browsed on it. The NTFS change journal pins each file operation to the minute across the weeks in question. When these artefacts are reviewed together, in the order they occurred, they take a case from "suspicion" to "record".
A significant amount of copying is done in a web browser instead. On the image we reconstruct webmail sessions with attachments sent to personal email accounts, auto-forwarding rules quietly applied to the mailbox, uploads through online file transfer sites, and sync clients uploading entire folders to a personal cloud account. Where the business uses Microsoft 365 or Google Workspace, we collect the tenant's own audit logs as well, so the device's story and the service's story can be compared line by line, and each supports the other.
The report is written for a non-specialist audience advised by a specialist. Findings come first, numbered and dated, each traceable to the artefact it is based on. The technical workings sit in an appendix, and the exhibit schedule includes SHA-256 hash values for every image. Where the parties' solicitors agree directions, the examination follows them exactly. Nothing is claimed beyond what the record supports, which is exactly why the record tends to be believed.
How imaging and custody work across a whole case is covered at the forensic recovery hub; the connection history detail is on the USB device forensics page, and preservation practice is set out under legal hold & chain of custody. Fees can be found on our prices page.
Each item below is provided as a numbered, dated finding with reference to the artefact supporting it: a record that a tribunal or court can rely on.
A leaver's computer will typically give up all of this information at once when it is imaged in good time.
The make, model and serial number of each device attached, along with first seen and last seen dates.
Destination timestamps and journal entries showing when files were placed on the device, at stated times.
Link files and jump lists that tie named documents to the stick's drive letter.
Webmail sends, forwarding rules and personal cloud syncing, as recorded on the machine.
After-hours patterns, repeated access, and communications relevant to the employee's state of mind.
The date and time the image was taken, compared with the departure date and verified by an SHA-256 hash.
Your free diagnostic is completed within two working days of us receiving your device; forensic work is paid for upfront as soon as you have accepted our fixed price quotation. Our standard cost for a full forensic examination and report is £800 plus VAT, which you pay in full in advance. A lower-cost alternative service that provides a forensic binary image of your drive(s) together with deleted file extraction, but does not include a report, is available for £400 plus VAT. These services and their costs are shown on our costs page, and we will confirm the details of the written scope prior to taking payment from you.
All issues related to employees are handled using the employer's equipment, as directed by the HR department or as instructed by a solicitor. We accept instructions on only three bases: that the equipment is owned by the company; that we have been instructed by a solicitor, an insurer or a court; or that the equipment genuinely belongs to the client (including machines owned jointly by spouses in matrimonial disputes). We don't hack into computer systems, and we don't intercept live communications. Nor will we inspect any device the instructing client has no right to examine.
Exhibits need to be processed under agreed procedures. For a quotation and to organise the packaging and documentation for your hard drives, please call 0800 689 0668. We take the drives (not the machine), and once they are signed for at our Leeds lab, our custody record of the drives begins. The drives can be sent tracked next day from York, or handed in at the reception of our Leeds lab on Albion Street, which is open Monday to Friday, 9am to 5:30pm, with no appointment needed.
Is the hard drive or SSD still inside a machine, like a laptop, MacBook, iMac, CCTV/DVR system or server? Take the hard drive or SSD out of the device and post the bare drive alone; we do not offer a service for removing drives from devices. For a server or RAID, send every disk, clearly marked with the bay it belongs in. For a NAS, send us the disks labelled by bay if you can remove them, or send us the NAS itself. We cannot work on storage that is soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out of the device, it can't come in. If you're unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have received a quotation, please send your package to Leeds Data Recovery. Leeds is approximately a forty-minute drive from York via the A64 and then the A1(M); alternatively you can use a trackable postal service, which should take one working day. On receipt of your package, we will get back to you as soon as possible to confirm that we have received it and place it into our queue for processing.
Not sure what to pack? Give us a ring on 0800 689 0668 before you start, or try our free online diagnostic instead.
Switch it off, call the freephone number and let the image do the talking.