A software developer near Heslington leaves his job; three months later, a competitor demonstrates a function that took your team two years to develop. For York's engineering, software and design businesses, we take that recognition and convert it into an itemised, dated report of what left, by which means, and how the competitor's material compares to your originals.
◇ Speed after method. The free assessment and a written scope of works come first. Forensic fees are paid upfront in full once you accept the fixed quote, before we start examining anything. On other work, in most cases you only pay if we recover your data, and electronic, mechanical and chip-level work is 50% upfront, with the balance only if we recover your data. All of our prices are shown on our data recovery cost page.
Product, engineering and design studio companies generally discover this first. It is important to preserve evidence before conducting an investigation, and certainly prior to confronting anyone.
Trade secrets typically leave via legitimate access and normal use of a company computer during working hours, rather than via unauthorised access. This type of theft can go undetected until months after the fact, i.e. when a bid is lost by an uncomfortable margin or a product is launched with familiar geometry. What it leaves behind are three answerable questions: "what" was taken, "how" did it get out, and "when" did it happen? Your company's own systems already hold the answers to all three. They simply need to be read.
We begin our reconstruction from verified images of the relevant workstations and file server. We track the exit path end to end using device records showing design sets and repositories leaving together. Next, we review traces from browsers and sync clients to determine whether files were uploaded into private storage. We also look at the print trail surrounding protected folders, and recover deleted files where a clean-up was attempted. Once the path is reconstructed, we sweep the image for any references to your part numbers, project names or other confidentiality markings, to ensure that renamed copies are not missed due to technicalities.
When your material is already in someone else's hands, it is the line of descent that will be contested. Office documents, PDFs and CAD drawings contain internal fields for author and company, revision history, reference numbers and save timestamps, all of which remain even after a document has been renamed and altered through normal editing. Compared against your original document(s), these internal fields can show how a rival document has descended from one of yours. The rival material has to arrive by a lawful route (disclosure, or an order of the court), and on that footing the comparison turns resemblance into evidence a judge can weigh.
Your IP claim is shaped in its first couple of weeks. Prompt imaging fixes the record before any tidying up, and that is the difference between a springboard or search-order application built on evidence and one built on guesswork. Machines come out of service and get imaged straight away; reports are prepared to evidential standards, with the findings ahead of the technical appendix; and if a court orders imaging of a respondent's hardware, we carry out the order exactly as drawn. Covert collection is no part of what we do.
The larger approach is set out at the forensic recovery hub. There are dedicated pages for removable media evidence at USB device forensics, for misused credentials at insider threat forensics, and for fees see our prices page.
Between them, they turn a rival product that looks all too familiar from a grievance into a record.
Design libraries, repositories and databases, leaving together.
Part numbers for the product, project names and confidentiality banners, all located on the image.
Internal document records tracing an opposing party's file back to yours.
Webmail, transfer sites and uploads to personal cloud accounts, all dated.
Erased files and archived material restored back into the record.
Activity regarding opens, exports and prints of the protected files.
The free diagnostic that opens every case is completed within two working days of arrival; forensic casework itself is paid upfront once you accept the fixed quote. Our standard fee for a full forensic investigation including report is £800 plus VAT, payable 100% upfront. The cheaper forensic binary image and deleted-file extraction service, without the report, is £400 plus VAT. Both figures are itemised on our prices page, and the written scope is agreed before payment is taken.
These IP matters proceed on your company's own property (its own "estate"), or on hardware that a court has ordered to be imaged, strictly within the terms of that order. Instructions are accepted on three footings only: equipment the company itself owns; the instruction of a solicitor, insurance company or court; or devices that are genuinely the client's own, including jointly owned machines in matrimonial matters. We do not "hack", nor do we "intercept" live communications, nor do we access a computer or machine the instructing client has no right to inspect.
The opening hours of an IP case set the maximum level of evidence. Contact us today on 0800 689 0668, leave the machines untouched, and once you have your quote we will agree which drives travel and how: safely to our location in Leeds, with custody recorded from signature.
Is the hard drive or SSD still inside a machine, such as a laptop, MacBook, iMac, CCTV/DVR system or server? Please remove the hard drive or SSD from the machine first and then post just the bare drive by itself; we do not provide a service for removing drives from devices. For a server or RAID, send every disk, each clearly marked with its bay. For a NAS, send its disks labelled by bay if you can remove them, otherwise send the NAS itself. We cannot work on storage soldered to the motherboard (e.g. Apple Silicon Macs, T2 Macs and certain slim laptops): if it doesn't come out, it can't come in. If you are unsure whether your storage is removable, call us before sending.
↓ Print the booking-in & shipping form (PDF)
Once you have your quote, send your package addressed to Leeds Data Recovery (about a 40 minute drive from York on the A64 & A1(M) or next working day if you want to send it using trackable post). We will contact you as soon as we have taken delivery of your package and put it in line to be worked upon.
Can't figure out what to pack? Ring 0800 689 0668 first, or try our free online diagnostic tool.
Take the machines out of use and dial the freephone: early images give the injunction a firm foundation.