Employee Data Theft Investigations

An engineer resigns from a service company at Altens. The laptop comes back. Six weeks on, a client list that took years to build is being worked by a rival. That machine usually settles matters, provided nobody signs into it beforehand. We work from the copy, and report only what the copy will carry. Nothing further.

Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.

// reasons to pull the machine today

Six things worth acting on at once

Any single one of these justifies taking the device out of service and leaving it alone until an image exists. City-centre office or Aberdeenshire yard, same rule.

The laptop came back reinstalled and nobody had authorised it
Portable drives started showing up once notice had been served
Company documents left for a private address in small batches
Someone's own Dropbox, OneDrive or Google Drive is logged in on work kit
Whole shared folders opened at night, ahead of the resignation
Your clients report approaches from wherever that person has landed

Hour one is spent doing nothing whatever

Restraint wins these cases, not effort. Sign in and fresh data lands on top of the old. Let IT have a quick look and the dates move on precisely the folders in dispute. Send it to the rebuild queue for the next starter and the matter is finished. So the drill is short and boring. Power down. Label it. Write who has had it. Put it away. Everything afterwards runs against a copy that verifies, and the laptop stays sealed for the other side's examiner if they want their own look at it.

The notes Windows keeps whether you ask or not

An operating system has a better memory than most witnesses. USBSTOR keeps maker, model and serial number for each stick, card reader or portable drive the machine has met, while setupapi.dev.log pins the first appearance of each to the second. LNK records and jump lists connect named documents to whichever letter the removable volume was handed. Shellbags retain the folder tree somebody walked through while it sat mounted. $UsnJrnl puts each operation on a clock across the weeks in question. Taken together, that is the difference between a suspicion and an instruction a solicitor can act on.

A great deal of copying never touches a port

Much of it goes through the browser instead. Off the copy we pull webmail sessions with attachments addressed to a private account, rules dropped into a mailbox so chosen mail forwards itself with nobody watching, uploads via file transfer sites, and sync clients quietly mirroring folders into somebody's personal storage. Where the firm runs Microsoft 365 or Google Workspace, tenancy audit records come in alongside. Then there are two accounts of the same fortnight, the machine's and the service's, and either they agree or they do not.

Written for a panel, not for another examiner

The audience is a tribunal panel with a specialist at its elbow. Findings go first: numbered, dated, each pointing at the artefact underneath it. Technical explanation goes to an appendix. The exhibit schedule carries a SHA-256 value against every image. Where solicitors have agreed directions, the examination stays inside them and nowhere else. Nothing is stated that the record will not carry. That is usually why the record gets believed.

How imaging and custody run right across the practice is set out on the forensic recovery hub. For connection history, see USB device forensics. Preservation is legal hold and chain of custody. Figures are on the prices page.

// the findings, taken one at a time

What ends up in your case file

Every item below comes back as a numbered, dated finding, with the artefact supporting it named alongside. A sheriff or a tribunal panel can work straight from that.

// what a single laptop normally yields

Six threads out of one machine

Lifted before the device is reissued, a leaver's computer generally gives up all of it.

Device register

Every item attached, by maker, model and serial, with first and last dates.

Transfer timings

Journal operations and destination stamps that place files on a device at a stated hour.

Opened-from traces

LNK records and jump lists connecting named documents to the letter in use.

Exit routes

Webmail traffic, mailbox rules and personal sync activity left on the disk.

Context

Repeat visits, out-of-hours sessions, and messages that speak to planning.

Preservation proof

Capture stamp against leaving date, carried by SHA-256 values.

// the price, and who we may act for

Forensic fees, and the footing underneath them

The money, stated plainly

Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.

The footing we need

Employee instructions run on equipment the business owns, backed by HR or by a solicitor. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.

// getting your device to us

Getting it to the bench — plainly done

Once a machine becomes an exhibit it travels on terms agreed in advance. Ring 0800 689 0668 and we will sort wrapping and paperwork. No collection service is offered, so it arrives tracked and insured or over the counter, and the custody log opens the moment it is signed for in Edinburgh.

Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.

  • Bubble wrap, then a rigid box or padded envelope packed tight enough that nothing rattles. Keep the cables, caddies and power bricks at home.
  • Print the shipping & booking-in form (PDF). Name, mobile number, two lines on what went wrong. In the box with the drive.
  • Royal Mail Special Delivery is tracked and insured door to door. Your own courier account does the same job if you would rather use it.
  • Handing it over yourself instead? Reception takes drop-offs at the address below, Mon–Fri 9:00am–5:30pm.
// where your device is headed

Edinburgh Data Recovery

4 Redheughs Rigg
Westpoint, South Gyle
Edinburgh, EH12 9DQ

↓ Print the shipping & booking-in form (PDF)

Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.

Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.

// employee data theft · asked before instruction

What employers ask first

Usually, yes. Resetting a machine is a loud thing to do. It leaves a date. Large parts of the registry and the journal come through it intact. Unallocated space still holds a share of what was destroyed. And a reset nobody authorised is a useful fact by itself. Keep the machine powered down and out of the rebuild queue.
Telling those two apart is the examination. On its own a connection proves very little. LNK records, jump lists, shellbags, journal operations and the stamps at the far end get read together until a named document is shown sitting on one named device at a stated hour. Produce the stick as well and it firms up further.
Over kit the business paid for and issued, usually yes, and where an acceptable-use or IT policy was signed there is not much argument left. The footing is confirmed in writing beforehand. Where a solicitor is instructing, we take the instruction from them. Property belonging to the former employee stays untouched.
Numbered findings, each with its source named. A dated sequence of events. An exhibit schedule carrying SHA-256 values. An appendix covering method. And the custody log. It is prepared to evidential standards suitable for an employment tribunal sitting in Scotland. Admission is the panel's decision. Leaving them no reason to hesitate is ours.

The record is still on that laptop. Leave it there.

Power it down, ring the freephone, and a verified copy can do the answering.