You don't usually know when you have a problem with someone who works for your organisation. A departing employee can still use their credentials. An export can be done during office hours. The archive can be created the night before an employee resigns. We investigate using your company's own records (endpoint, server, network) and report what they establish, attributed to accounts, sessions and times.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
It's these observations that take an uncomfortable feeling and create a directive.
Employment terminates before access does. Password managers and credential caches are also copied when an employee copies their profile. SSH keys and API tokens copied by an employee in their last week will remain active until they are manually revoked. A colleague's password, seen one time, can continue to work from home. The investigation determines which credentials were taken. The investigation then uses endpoint trace data along with logon authentication events to determine which systems were accessed using those credentials, from which address(es) and during which times. Access after the employee's departure is usually what decides these types of cases.
Half of the story is told by endpoints and the other half is told by servers. The history of database queries tells us about the bulk exports (the SELECT statement that took a specific table, with its time and author); we can compare snapshots and backups to determine the exact date when records changed or were deleted; file server access log entries will show who accessed which share and when the user's actions deviated from their normal behaviour; and network traffic records and captures will reveal continuous data transmissions to addresses outside of your organisation that cannot be explained through any legitimate business process. Evidence from the servers also deteriorates quickest, as most logs rotate on schedules measured in weeks, so it is captured first.
Tribunals make distinctions between "carelessness" (negligence) and "planning", therefore the investigation will collect data about mindset, including Slack and Teams messages regarding the move or the materials; 7z and RAR archives assembled during the last days (their contents lists recovered even where the archives are gone); competitor websites and job postings found in browsing history; and document metadata with the "last modified by" field referencing named hands on named files at named times. Each piece of evidence may be insufficient in isolation but typically is sufficient when sequenced together.
A personal device (e.g. a phone or laptop) on the company's office network sits on a legal boundary for the investigator, and we remain on the lawful side of it. Information derived from the office network (association times, device identifiers, volume of traffic, destinations) is owned by the employer and can be used as evidence. The personal device itself cannot be examined without its owner's permission, a procedure agreed with solicitors, or a court order directing such examination. The report will include only information that the office network lawfully shows and clearly states the boundary. This is why it remains usable.
The forensic imaging discipline used here is at the forensic recovery hub. Mailbox and cloud routes continue on email & cloud exfiltration, endpoint capture on workstation deep imaging, and the IP aspect is covered on the trade-secret case page. Costs are on our prices page.
Tied to accounts and sessions, dated and tied to the systems' own records.
Which keys, tokens and stored passwords were taken, and when.
Systems accessed using taken credentials, time-stamped and linked back to a source.
Bulk database or file-server data extraction, with evidence of the queries used.
Sustained network transmissions to external addresses (i.e., outside your network), identified by capture and log data.
Messages, archives, browsing history and metadata relevant to planning.
Information about personal devices that the Wi-Fi records lawfully show.
We complete the free diagnostic for each case within two working days of receipt; forensic casework itself is paid upfront once you accept the fixed quote. The price of the full forensic analysis with report is £800 + VAT, payable 100% upfront. Our less expensive "Forensic binary image" and deleted-file extraction service, which does not include a report, is £400 + VAT. Any forensic work required will need to be paid for upfront. Multi-system server scopes are quoted in writing after the free assessment. Both prices can be seen on our prices page, and the written scope is agreed before payment is taken.
Insider cases typically use the organisation's own systems and records, instructed through HR or a solicitor. We take instructions on three footings only: equipment the organisation itself owns; the instruction of a solicitor, insurer or court; or devices that truly belong to the client, including jointly owned machines in matrimonial matters. We do not "hack", we do not intercept live communications and we do not inspect a device that the instructing client has no right to examine.
The majority of insider cases begin with a scoping telephone call instead of sending a package. Call 0800 689 0668 and describe what you are experiencing, and we will provide you with a list of items to be preserved tonight. Where drives do need to travel (the drives, not the computers), they are sent once you have your quote and are signed into custody at our Leeds location on arrival.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Do not wait until the logs have rotated to contact us; the freephone line goes directly to an examiner, not into a call centre queue.