When an item is sent out through a mailbox or a cloud account it will be logged in two places. The first log entry will be on the sending equipment. The second log entry will be from the sending service. Any sound forensic examination reads both logs. Your tenancy provides information such as mailbox rules, the history of attachments and your sign-in patterns. Your device provides records related to your browser and what you have synced. After these two logs are aligned by date and time into a single account, they can be presented to the professional and legal offices along Union Street and to the energy consultancies that instruct them.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
Each of these can be explained in terms of innocence; all when put together form a pattern that is worthy of investigation.
Mailbox behaviour when it is being used to shift information has identifiable characteristics. The size of attachments increases as the number of recipients decreases to just one private email address. Rules begin to appear that automatically forward selected messages without anyone seeing them. Searching for emails seems like it's focused on hunting rather than working (e.g., searching by client name, project code or price list). As time passes, access to the email platform drifts into evenings and weekends. Mail platforms record every bit of that, and each item is pulled out and dated during the examination.
The device will reveal the second half of the information. Browser traces capture when an employee creates an account, then signs in to a Dropbox, OneDrive or Google Drive account using company equipment. From sync-client logs and the folder layout it can be determined which folders were set to mirror upward, and from what date. The upload residue (cached web pages, confirmation screens and recent file lists) remains on the image long after an employee clears his or her browsing history. A personal account appearing on company hardware during a final month usually does not occur by accident.
Microsoft 365 and Google Workspace have their own data to prove things, and it frequently decides matters. How messages are moved, shared and downloaded: all that shows up in a Microsoft Purview audit log or is exported via eDiscovery. Google Vault retains email and files. Every time someone shares something on SharePoint or OneDrive, or bulk downloads it, the logs record which account did it and at what hour. If you use Dropbox, it keeps your file versions so you can go back to previous versions if needed, as well as recover deleted items. While a deleted mailbox can often be recovered through a retention period or a backup, that won't last for ever. That's why it makes sense to ring us early.
The findings are persuasive when they align to each other. A tenancy log indicates that there was a 3.4 GB download at 22:38. Two minutes later, those exact files appear in a user's personal sync folder on their computer. And then you see this in browser history as well. All of the service evidence and machine evidence are tied together for a complete run and if there is any disagreement we flag this instead of ignoring it. Everything, whether it be the mailbox export, the audit extract or the disk image, will have been hashed prior to the suspension of any account or the reclaiming of any licence.
The method beneath the practice itself lies within the forensic recovery hub, and insider threat forensics covers credentials and server records. Employer casework will be covered by employee data theft, while the holding material will be found on legal hold and chain of custody. Figures for price will be located on the prices page.
Machine traces and service records matched up against each other and set out together as one run.
What items were sent to private addresses? At what size? On what date(s)?
Forwarding and deletion rules, their creation dates, and what they caught.
Sign-in hours and locations, with out-of-hours clusters marked up.
Personal accounts, sync folders and upload leftovers on work kit.
Share, download and export events lifted from M365 and Workspace logs.
Messages and entire mailboxes brought back from retention or backup.
Every single instruction begins at the free diagnostic. We normally allow 2 working days after we receive a device for it to go through the diagnostic. Forensic casework is outside of our normal payment terms, where in most cases you only pay if we recover your data. The cost of a complete forensic investigation with written report is £800 + VAT. This amount is due 100% upfront. The lower cost forensic option, creating a binary image of your drive and extracting any files that have been deleted but are still recoverable, without the report, will be £400 + VAT. Any forensic work will be payable upfront. If the work we need to do spans multiple accounts or the entire tenancy, then we will quote in writing once the free diagnostic has completed. Both prices are listed again on the prices page and we don't take anything until there is a written agreement on the scope of work.
Mailbox and cloud work is carried out on tenancies and devices the company owns, or on the written instruction of a solicitor. There are three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction from a solicitor, an insurer or the court. Or otherwise a device that genuinely belongs to the client, which in a matrimonial matter includes one held between the two of them. Nothing gets hacked at our bench. Live traffic is never intercepted. If the instructing client has no right to look inside a device, then neither do we.
Cloud data is typically preserved by export, and not in parcels. Please call us on 0800 689 0668 to get a quote first, and we can determine what can be captured remotely versus what may have to physically come to Edinburgh. Since we do not offer a collection service, any items that need to be sent physically will arrive here tracked and insured, or you can hand them over the counter in person, Monday to Friday, 9am to 5:30pm, with no appointment needed. Custody of all physical items begins the moment they are signed for.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
The retention window for evidence closes on its own timeline and not on your timeline. Call our freephone number first.