An engineer quits a service firm in Altens. A laptop was returned. Six weeks later, a client contact database built over many years is now being used by a competitor. That computer will usually settle matters, provided nobody has signed onto it beforehand. We work with a duplicate of the data, and report only as much as the copy will allow. Nothing further.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
Any one of those reasons is sufficient to remove the device from service and leave it idle until there is an image. That is equally true whether you're in the middle of the city, or at a yard in Aberdeenshire.
Effort doesn't win these cases, restraint does. The new data will go right on top of the existing (old) data when you sign in. If IT has a quick look, the dates move on exactly the folders in dispute, and if it goes to the rebuild queue for the next starter, the matter is finished. So the drill is extremely short and completely boring. Shut down. Label it. Write down who has had it. Store it. After that everything will be run from a verified copy, and the original drive will stay sealed in case the other party's forensic examiner wants to take a peek themselves.
An operating system has far greater memory than many witnesses. The USBSTOR database contains the manufacturer, model number and serial number for every stick, card reader or other type of portable drive your computer has encountered, and the setupapi.dev.log file records, to the second, when each one first appeared. Jump lists and LNK records will show you how your computer connected named documents on removable media (such as a flash drive) to the letters assigned to those storage devices. Shellbags contain information about all folders a user navigated to while the removable media was still attached. $UsnJrnl shows you what time each operation occurred across the weeks in question. Together, these records provide the evidence needed to turn a suspicion into something a solicitor can act upon.
Much of this data moves through the browser instead. From the copy, we pull webmail sessions with attachments being sent to a private account, rules added to a mailbox so that chosen emails forward themselves without anyone watching, uploads through file transfer sites, and sync clients silently mirroring a user's folders into their personal storage. If the firm runs Microsoft 365 or Google Workspace, we get the tenancy audit records along with those as well. That leaves two accounts of the same fortnight, the machine's and the service's, and either they agree or they do not.
The report is written for a tribunal panel with a specialist sitting at its elbow. Findings go first, numbered and dated, and each one points to the artefact that sits underneath it. Technical explanations go into an appendix. The exhibit schedule carries a SHA-256 value against every image. Where the solicitors involved have agreed directions, the examination stays within them and nowhere else. Nothing is stated that the record will not carry, and that is generally the reason why the record gets believed.
How we manage imaging and custody throughout our practice is explained on the forensic recovery hub, while the history of connections is covered by USB device forensics. Legal preservation is legal hold and chain of custody. There are figures about cost on the prices page.
Each of the items listed below will be returned as a dated, numbered finding with the name of the artefact that supports it. A sheriff or tribunal panel could then use this information directly.
Captured prior to reissue, a departing employee's computer typically gives up everything.
All items attached (by manufacturer, model and serial number), along with the earliest and latest dates they were connected.
Destination timestamps and journal entries for where files were placed on a device at a specific time.
LNK entries and jump lists showing how named documents connect back to the drive letter in use.
Disk evidence of webmail exchanges, mailbox rules and personal sync activity, which have been saved to the computer.
Repeat visits, out-of-hours sessions, and messages that speak to planning.
Capture stamp against leaving date, carried by SHA-256 values.
Every instruction starts with the free diagnostic, and you should allow 2 working days from the date a device reaches this bench. Forensic work is not covered by our usual payment terms, where in most cases you only pay if we recover your data. The full forensic investigation with report costs £800 + VAT and must be paid 100% upfront. The less expensive Forensic binary image and deleted-file extraction service (which does not include a report) will cost £400 + VAT. All Forensic services are required to be prepaid. Both figures are repeated on our prices page and we do not take anything until we have agreed upon a scope of works in writing.
Employee instructions are taken on hardware owned by the business, supported by either HR or a solicitor. We've been through three doors and never found a fourth. Equipment that the company owns. A written instruction from a solicitor, an insurer or the courts. Otherwise, a device that the client actually owns (which in matrimonial matters will include something they both own together). Absolutely nothing gets hacked at our bench. We never intercept live traffic. If the instructing client has no legal right to access what is inside a device, then neither do we.
Once a machine has become an exhibit, we only need its hard drive, and the way the drive travels is governed by terms agreed in advance. Ring 0800 689 0668 for a quote first, and we will sort out the wrapping and paperwork. There is no collection service, so it arrives with us tracked and insured, or it can be handed over the counter, Monday to Friday, 9am to 5:30pm, with no appointment needed. The custody log opens the moment it is signed for in Edinburgh.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Shut off the power, call our freephone number and a verified copy will provide answers.