Insiders who cause real harm never make their presence known. Access continues to function after the employee's last day of work. An export runs mid-afternoon on a Tuesday. The archive gets built the night prior to an employee resigning. The investigation is made by taking the relevant records that already exist within the organisation (endpoints, servers and networks) and determining what these records will carry against named accounts, sessions and time frames.
◇ Footing first, then the bench time. It all begins with the free diagnostic, which is then followed by a written scope, and forensic fees must be paid before any actual examination can take place. Generally speaking, in most cases you only pay if we recover your data; the exceptions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. Full pricing can be found on the data recovery cost page.
What these are is how an uncomfortable feeling turns into instructions in writing.
Access lasts longer than most employers intend when an employee leaves. Copy a profile and the stored cache of credentials (which includes the password manager store) will be copied with it. Until they are revoked, all keys and tokens taken in the last week still work. A password viewed once over a desk works as well from a kitchen table. Thus, the first step is to identify what credentials were removed and then review both authentication logs and endpoint trace files until the systems reached can be listed by source IP address and hour. All events occurring after the departing date are included; this is commonly the part that decides it.
When considering endpoints as a source of data for an investigation, remember they are generally limited to providing half the information. On the other hand, query history can provide an overview of how data was extracted at scale; specifically the SELECT statement used to pull up a client's table, along with the timing and ownership by a particular account. When backups and snapshots are placed in tandem, it is possible to identify the time at which a record either changed or disappeared. The logs on a file-server will reveal what shares were accessed by whom, and where the first break occurred from an established pattern. Network activity and network captures may reveal sustained large-scale transfers to addresses that no business process within the organisation explains. In addition, server material deteriorates at a much faster rate than almost everything else; this is due to log rotation based on schedules (measured in weeks), and it is therefore placed atop the preservation list. Capture methods targeted at specific servers allow businesses to continue operating while the evidence is being preserved; this is particularly important when the server in question runs job costing.
The tribunal will make its own assessment as to whether the evidence indicates careless error or intentional planning, so the investigation gathers all the information that speaks to it. Traffic on Teams and Slack regarding the move or the material. Compressed files (RAR or 7z) created over the past few days, which frequently retain their contents lists after being deleted. Job boards and competitor websites appearing in browsing history. Metadata with a last-modified-by value listing a named account against a named file at a specified hour. While individually none of these pieces of evidence is conclusive, collectively they generally are.
Somebody's own phone or computer on your office Wi-Fi places us right next to a legal boundary, and we always remain on the lawful side of it. Whatever your network has recorded is company property and perfectly fair evidence: association times, the identifier of the hardware used, how much volume was carried and where it went. There is no way that we can examine the equipment itself without permission from the owner, a procedure agreed between solicitors, or a court order, and we do not take in any phones or tablets at all. Reports generated here are based on what the infrastructure lawfully shows, and they state where this boundary lies, which is exactly what keeps these reports useful.
The discipline of image creation behind this service falls to the forensic recovery hub. If the exit method uses a tenancy as part of that, see email and cloud exfiltration. Workstation deep imaging captures endpoints. Trade secrets would be covered on the IP theft page. Costs are listed on the prices page.
These can link the account and its session to a time and trace it back into the systems' own logs.
Which keys, tokens and stored passwords went, and when.
The systems reached with them, by hour and source address.
Extracting data on a large scale from databases and file servers, backed by query-based evidence.
Steady outbound transfers to external addresses, out of logs and captures.
Messages, archives, browsing and metadata that speak to intent.
What Wi-Fi records lawfully show about a personally owned device.
All instructions open at the free diagnostic stage. Allow 2 working days from the date a device reaches this bench. Forensic casework is not covered by our standard payment terms, where in most cases you only pay if we recover your data. The full forensic investigation including detailed forensic report costs £800 + VAT, payable 100% upfront before we start. A less expensive Forensic service is available that includes only the creation of a Forensic binary image and deleted-file extraction, and does not include a report; this option costs £400 + VAT. We do require all Forensic work to be paid for upfront. If a job requires us to investigate multiple servers then we will quote in writing once the free diagnostic is done. Both figures are listed on the pricing page, and no payment will be taken until a scope has been agreed in writing.
Insider instructions run on systems and files owned by the company, through HR or via a solicitor. Three doors in, and there hasn't yet been a fourth door. Kit owned by the business. A written direction from a solicitor, insurer or court. Or else a client-owned device, including those shared with another party in matrimonial matters. We don't hack here. We're not intercepting live data. Where a client has no right of access to see what's stored in a device, neither do we.
These cases generally start as a scoping call rather than a parcel. Ring 0800 689 0668 and explain to us what you are seeing; we can then provide you with an outline of what you need to preserve prior to this evening. We do not offer collection for items here. For any hardware that requires transportation (we only need the hard drives, not the machines), please contact us to obtain a quote first, after which it can be sent via tracked and insured post, or handed in at our Edinburgh premises Monday to Friday, 9am to 5:30pm, on a walk-in basis with no appointment needed. Once received in Edinburgh it will be booked into custody.
Still attached to a laptop, desktop, MacBook, iMac, server or CCTV/DVR unit? Remove the hard drive or SSD first. The bare drive travels on its own; when removing disks from a server remove all the disks and label each disk by its bay. This lab does not take machines apart. Any storage that has been soldered onto a motherboard (as in T2 and Apple Silicon Macs and a couple of thin laptops) will not be worked on: if it will not unbolt, we cannot work on it. If you're not sure what type of machine you have, ring us first. Phones and tablets are also not taken on.
↓ Print the shipping & booking-in form (PDF)
Your parcel should be addressed to Edinburgh Data Recovery, approximately two and a half hours (and 130 miles) from Aberdeen via the A90; alternatively it can reach us the next working day by tracked post if this journey time / distance is prohibitive to travel. As soon as your drive has been scheduled in we will contact you.
Still unsure about what should be placed inside of the packaging? Please call us first on 0800 689 0668, or use our free online diagnostic tool to assist you in deciding which items belong inside of the packaging before sealing.
Save those logs before they are rotated. The freephone connects you directly to an examiner, not a queue.